modeling and analysing propagation behavior in complex
TRANSCRIPT
HAL Id: tel-01018574https://tel.archives-ouvertes.fr/tel-01018574
Submitted on 4 Jul 2014
HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.
L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.
Modeling and Analysing Propagation Behavior inComplex Risk Network : A Decision Support System for
Project Risk Management,Chao Fang
To cite this version:Chao Fang. Modeling and Analysing Propagation Behavior in Complex Risk Network : A DecisionSupport System for Project Risk Management,. Other. Ecole Centrale Paris, 2011. English. �NNT :2011ECAP0052�. �tel-01018574�
ÉCOLE CENTRALE DES ARTS ET MANUFACTURES
« ÉCOLE CENTRALE PARIS »
THÈSE présentée par
Chao FANG
pour l’obtention du
GRADE DE DOCTEUR
Spécialité : Génie Industriel Laboratoire d’accueil : Laboratoire Génie Industriel SUJET :
Modeling and Analyzing Propagation Behavior in Complex Risk Network: A Decision Support System for Project Risk Management soutenue le : 02 Décembre 2011 devant un jury composé de : M. John CLARKSON, Cambridge University Rapporteur M. Didier GOURC, Ecole des Mines d’Albi-Carmaux Rapporteur M. Min XIE, City University of Hong Kong Examinateur M. Jean-Claude BOCQUET, Ecole Centrale Paris Directeur de thèse M. Franck MARLE, Ecole Centrale Paris Co-encadrant de thèse M. Enrico ZIO, ECP-Supélec, Politecnico de Milano Membre invité
2011ECAP0052
- 2 -
- 3 -
Table of Contents
ABSTRACT ......................................................................................................... - 7 -
CHAPTER 1 - BACKGROUND AND RESEARCH PROBLEM...................... - 9 -
1.1 Introduction to project risk management................................................................- 10 -
1.1.1 Project Management.......................................................................................- 10 -
1.1.2 Project risk management (adapted from (Marle 2008)) .................................- 11 -
1.1.2.1 Project risk identification ...........................................................................- 12 -
1.1.2.2 Project risk analysis....................................................................................- 12 -
1.1.2.3 Project risk response planning....................................................................- 14 -
1.1.2.4 Project risk monitoring and control............................................................- 14 -
1.2 Increasing complexity of project and associated risks ...........................................- 15 -
1.2.1 Complexity of project.....................................................................................- 15 -
1.2.2 Complexity of project risks ............................................................................- 17 -
1.3 Limitation of current methods for managing real complexity................................- 19 -
1.4 Research questions .................................................................................................- 21 -
1.4.1 Risk analysis under complexity......................................................................- 22 -
1.4.2 Risk response planning under complexity......................................................- 22 -
1.5 Research approach .................................................................................................- 23 -
1.5.1 A new integrated decision support system for PRM......................................- 23 -
1.5.2 Case studies....................................................................................................- 27 -
1.6 Conclusion..............................................................................................................- 27 -
CHAPTER 2 - PROJECT RISK NETWORK MODELING............................ - 29 -
2.1 Building the risk network structure........................................................................- 30 -
2.1.1 Identification of project risks .........................................................................- 30 -
2.1.2 Identification of risk interactions ...................................................................- 31 -
2.1.2.1 Basics of the DSM tool for modeling interdependencies...........................- 31 -
2.1.2.2 Identifying and representing risk interactions in Risk Structure Matrix (RSM)
- 32 -
2.2 Assessment of the risk network..............................................................................- 34 -
2.2.1 Project risk assessment...................................................................................- 34 -
2.2.1.1 Risk assessment in terms of probability .....................................................- 34 -
2.2.1.2 Risk assessment in terms of impact............................................................- 35 -
2.2.2 Risk interactions assessment ..........................................................................- 35 -
2.2.2.1 Direct assessment by experts......................................................................- 35 -
2.2.2.2 Relative assessment based on pairwise comparison...................................- 35 -
2.3 Case study ..............................................................................................................- 37 -
2.3.1 Introduction to the case study.........................................................................- 37 -
2.3.2 Results ............................................................................................................- 38 -
- 4 -
2.4 Conclusions ............................................................................................................- 41 -
CHAPTER 3 - A SIMULATION-BASED RISK NETWORK MODEL FOR
DECISION SUPPORT IN PRM............................................................................ - 43 -
3.1 Brief description of the simulation model..............................................................- 44 -
3.2 Applications to support managerial decision-making ............................................- 44 -
3.2.1 Risk network analysis.....................................................................................- 44 -
3.2.1.1 Risk re-evaluation ......................................................................................- 45 -
3.2.1.2 Risk prioritization.......................................................................................- 46 -
3.2.1.3 Sensitivity analysis.....................................................................................- 46 -
3.2.2 Mitigation actions planning and test ..............................................................- 46 -
3.2.3 Risk network monitoring and control.............................................................- 47 -
3.3 Case study results and analysis ..............................................................................- 48 -
3.3.1 Simulation model of the project risk network ................................................- 48 -
3.3.2 Risk network analysis.....................................................................................- 49 -
3.3.3 Mitigation actions planning and test ..............................................................- 54 -
3.3.3.1 Local mitigation .........................................................................................- 54 -
3.3.3.2 Global mitigation........................................................................................- 55 -
3.4 Conclusion..............................................................................................................- 56 -
CHAPTER 4 - TOPOLOGICAL NETWORK THEORY-BASED PROJECT
RISK ANALYSIS .................................................................................................... - 59 -
4.1 Introduction ............................................................................................................- 60 -
4.2 Definition of topological indicators for project risk analysis.................................- 60 -
4.2.1 Connectivity indicators ..................................................................................- 61 -
4.2.2 Interface indicators.........................................................................................- 62 -
4.2.3 Betweenness centrality...................................................................................- 62 -
4.3 Eigenstructure analysis of risk network .................................................................- 63 -
4.4 Case study ..............................................................................................................- 65 -
4.4.1 Building the structure of project risk network................................................- 65 -
4.4.2 Classical project risk analysis ........................................................................- 69 -
4.4.3 Topological network analysis.........................................................................- 70 -
4.4.4 Eigenstructure analysis...................................................................................- 75 -
4.4.5 Discussion of the results.................................................................................- 75 -
4.5 Conclusion..............................................................................................................- 80 -
CHAPTER 5 - MATRIX-BASED PROPAGATION MODELING FOR RISK
ANALYSIS ....................................................................................................... - 83 -
5.1 Matrix-based risk propagation modeling ...............................................................- 84 -
5.1.1 Basic concepts and assumptions ....................................................................- 84 -
5.1.2 Risk propagation model .................................................................................- 84 -
5.1.3 A simple example for illustration ...................................................................- 86 -
- 5 -
5.2 Eigenstructure analysis on weighted risk network .................................................- 88 -
5.3 Case studies............................................................................................................- 88 -
5.3.1 Musical staging project ..................................................................................- 89 -
5.3.2 Tramway construction project........................................................................- 90 -
5.4 Conclusion..............................................................................................................- 93 -
CHAPTER 6 - OPTIMIZATION OF RISK RESPONSE PLAN UNDER
RESOURCE CONSTRAINTS............................................................................... - 95 -
6.1 An integrated framework for risk response planning.............................................- 96 -
6.2 Step-by-step for the optimization of project risk response plan.............................- 97 -
6.2.1 Building project risk network.........................................................................- 97 -
6.2.2 Defining objective function............................................................................- 98 -
6.2.3 Identifying budget constraints........................................................................- 98 -
6.2.4 Identifying potential response actions............................................................- 98 -
6.2.5 Optimizing risk response plan........................................................................- 99 -
6.2.5.1 A greedy algorithm.....................................................................................- 99 -
6.2.5.2 A genetic algorithm..................................................................................- 100 -
6.3 Case study ............................................................................................................- 103 -
6.3.1 Build the action list ......................................................................................- 103 -
6.3.2 Greedy algorithm results ..............................................................................- 105 -
6.3.3 Genetic algorithm results .............................................................................- 106 -
6.4 Conclusion............................................................................................................- 107 -
CHAPTER 7 - CONCLUSIONS AND PERSPECTIVES ............................... - 109 -
PUBLICATIONS .....................................................................................................- 113
BIBLIOGRAPHIES.................................................................................................- 115
LIST OF FIGURES .................................................................................................- 129
LIST OF TABLES ...................................................................................................- 131
- 6 -
- 7 -
Abstract
Project risk management is a crucial activity in project management. Nowadays, projects
are facing a growing complexity and are thus exposed to numerous and interdependent risks.
However, existing classical methods have limitations for modeling the real complexity of
project risks. For example, some phenomena like chain reactions and loops are not properly
taken into account. This Ph.D. thesis aims at analyzing propagation behavior in the project risk
network through modeling risks and risk interactions. An integrated framework of decision
support system is presented with a series of proposed methods. The construction of the project
risk network requires the involvement of the project manager and the team of experts using the
Design Structure Matrix (DSM) method. Simulation techniques are used and several network
theory-based methods are developed for analyzing and prioritizing project risks, with respect to
their role and importance in the risk network in terms of various indicators. The proposed
approach serves as a powerful complement to classical project risk analysis. These novel
analyses provide project managers with improved insights on risks and risk interactions under
complexity and help them to design more effective response actions. Considering resource
constraints, a greedy algorithm and a genetic algorithm are developed to optimize the risk
response plan and the allocation of budget reserves dedicated to the risk management. Two
examples of application, 1) to a real musical staging project in the entertainment industry and 2)
to a real urban transportation system implementation project, are presented to illustrate the
utility of the proposed decision support system.
Keywords: project risk management, complexity, risk interaction, risk network, risk
analysis, risk propagation, network theory, optimization, decision support system
- 8 -
- 9 -
Chapter 1 - Background and Research Problem
Abstract
Project risk management is crucial for the success of projects. In this chapter, we introduce
the basics of project management and project risk management. We argue that the increasing
complexity of projects leads to a complex risk network of interdependent risks. This increases
the difficulty for the project manager to anticipate the propagation of risks and then to make
reliable decisions with respect to risk management. An investigation of current methods and
tools of project risk management in literature shows that they are not able to properly represent
the real complexity of project risks. Research questions are put forward with regard to risk
analysis and risk response planning under this introduced complexity.
An original framework of decision support system (DSS) is thus presented, which is the
main purpose of this study. It consists of five phases: risk network identification, risk network
assessment, risk network analysis, risk response planning, and risk monitoring and control. This
DSS enables the project manager to model and analyze the risk network behavior and thus to
re-evaluate risks taking into account their interactions under complexity. The DSS is also able
to suggest risk mitigation actions and test their effects in the risk network. The decisions about
risk response planning can be optimized under resource constraints. Finally, the conclusions are
drawn and the organization of the following chapters is given.
Chapter Keywords
Project management, project risk management, complexity, risk network, risk propagation,
decision support system
- 10 -
1.1 Introduction to project risk management
1.1.1 Project Management
A project is a temporary and unique endeavor undertaken to deliver a result, typically to
bring about beneficial change or added value. The result of project is always a change in the
organization, whatever it is in its processes, performance, products or services. This
transformation consists then in a gap between a start and a final state. The final expected state
is better than the initial, but the uncertainty of the future makes it risky. Each project is unique
because there is always at least one of the following parameters that are dissimilar: targets,
resources, management, methods, tools, and context. Examples of projects include, but are not
limited to:
· Design and develop a new product or service
· Install a developed or acquired new information system
· Effect a change in the organization (structure, staffing or style) of an enterprise
· Constructing a building or infrastructure
· Implementing a new business process or procedure
· Conduct a series of marketing activities
All the kinds of projects in any fields need to be managed in order to keep them towards
the predefined targets or objectives. Project management has been practiced since early
civilization. Until 1900 civil engineering projects were generally managed by creative
architects, engineers, and master builders themselves (Lock 2007). In the 1950s, organizations
started to systematically apply project management tools and techniques to complex
engineering projects (Carayannis et al. 2005). In this sense, the 1950s marked the beginning of
the modern Project Management era where core engineering fields come together working as
one. Project management became recognized as a distinct discipline arising from the
management discipline with engineering model (Cleland and Gareis 2006).
According to the PMBOK® Guide from the Project Management Institute, Inc., project
management is “the application of knowledge, skills, tools, and techniques to project activities
to meet the project requirements” (PMI 2008). Project management is accomplished through
the appropriate application and integration of a number of grouped project management
processes comprising the five process groups. These five process groups are as follows:
· Initiating.
· Planning.
· Executing
· Monitoring and controlling
- 11 -
· Closing
Usually, a project manager and team members are assigned by the performing organization
to conduct project management activities for achieving the project objectives. Key project
management responsibilities include creating clear and attainable project objectives, building
the project requirements, and managing the constraints of the projects, which are scope,
schedule, cost, and quality, etc.
Many methods, tools, techniques, practices have been developed to date in the domain of
project management (White and Fortune 2002; Dean 1985; Cleland and King 1983;
Hendrickson and Au 2000; PMI 2008; IPMA 2006; Kerzner 1998; McManus and Wood-Harper
2003). Understanding and applying the specific and rigorous methodologies are recognized as
good practice for effective project management.
1.1.2 Project risk management (adapted from (Marle 2008))
Project risk management (PRM) is an important aspect of the project management. It is
crucial and indispensable to the success of projects. From the birth of project management, the
notion of risk has grown within the field of project management, even if there are still a lot of
theoretical problems and implementation lacks. The polysemous nature of risk may involve
confusions about similar terms such as uncertainty, alea, danger, hazard, etc. The PMI, in its
worldwide standard PMBOK®, defines project risk as an uncertain event or condition that if it
occurs, has an effect on at least one of the project objectives such as scope, schedule, cost and
quality (PMI 2008).
According to Raz and Hillson, “the origins of operational risk management can be traced
to the discipline of safety engineering” (Raz and Hillson 2005). Modern risk management has
evolved from this issue of physical harm that may occur as a result of improper equipment or
operator performance. Many risk management methodologies and associated tools have been
developed now in the context of project management, with qualitative and/or quantitative
approaches, often based on the two concepts of probability and impact (or severity) of the risky
event. The objectives of project risk management are to increase the probability and impact of
positive events, and decrease the probability and impact of negative events in the project (PMI
2008).
For all practical purposes, the growing interest in risk management is often pushed by law
and regulation evolutions. Indeed, risks in projects have become higher in terms of number and
global impact. Projects are more than ever exposed and averse to risks, and stakeholders are
asking for more risk management to cover themselves against financial or legal consequences.
People can be accountable during or after the project for safety, security, environmental,
commercial, or financial issues. That is why it has become increasingly important to effectively
and efficiently manage project risks , in order to give a higher guarantee of success and comfort
to project stakeholders, or at least to warn them against potential problems or disasters (Cooper
and Chapman 1987). Several standards have been developed in the field of risk management
- 12 -
and specifically in project risk management (APM 1996; BSI 2002; IEC 1995; IEEE 2001; ISO
2003; PMI 2008).
Because of the uncertainty nature and the potential for change, the project risk
management process is iterative and goes through progressive elaboration throughout the
project’s life cycle. Classical PRM process is comprised of four major phases (shown in Figure
1): risk identification, risk analysis, risk response planning, and risk monitoring and control.
These four phases will be described in the following paragraphs.
Figure 1. Classical steps of project risk management
1.1.2.1 Project risk identification
Risk identification is the process of determining events which, may they occur, could
affect project objectives positively or negatively. Risk identification methods are classified into
two different families:
1) Direct risk identification: The most classical tools and techniques are diagnosis and
creativity-based methods, for assessment of present or future situation.
2) Indirect risk identification: The other way to identify risks is to collect data about
problems that occurred during previous projects since problems of the past may be
risks of the future.
This step normally generates a list of risks. The number of risks in this list may vary from
some decades to some hundreds of risks, according to the scale and dimension of the project.
1.1.2.2 Project risk analysis
Risk analysis is the process of evaluating and prioritizing risks, essentially according to
their characteristics like probability and impact. Criticality is another characteristic with which
risks are prioritized. It is generally a combination of probability and impact, or is simply
defined as the product of them. As shown in Table 1, it enables us to classify risks into different
categories: high risk, moderate risk, and low risk.
- 13 -
Table 1. Definition of probability, impact, and criticality reference scales
Class Name Nature of consequences Class Name Interval of occurrence
I 1 Minor No disturbation P 1 Extremely unlikely < 0,01 %
I 2 Significant
Project is disturbed / Not
known by customer P 2 Very unlikely < 5%
I 3 Major
Project is disturbed /
Customer upset P 3 Unlikely [5%, 25%]
I 4 Critical
Very difficult situation /
Customer unsatisfied P 4 Likely [25%, 50%]
I 5 Disaster Project in death hazard P 5 Very likely > 50%
Class Level of risk Nature of decisions
C 1 Acceptable
C 2 Tolerable
Use of margins and
reserves. Monitoring.
C 3 Unaffordable
Launch of urgent
actions.
Impact (or gravity) Probability (or likelihood)
Criticality
There are two main types of risk analysis, which are discussed hereafter: qualitative and
quantitative analysis.
1) Qualitative analysis
It is the process of assessing by qualitative means the probability and impact of each risk.
It assists in risk comparison and prioritization. It is applied when parameters are difficult to
calculate, using qualitative scales, like in Table 1: from very low to very high, or from 1 to 5
for instance.
2) Quantitative analysis
The main difference with qualitative analysis is the possibility to give a quantitative value
to a risk, regarding its probability and/or its impact (gravity value). For instance, the probability
to get a “1” with a 6-faces dice is 1/6. The probability of a risk may sometimes be calculated by
capitalization of previous data, as long as the size of data sample is statistically significant. Risk
probability and impact are then assessed on a quantitative scale: €23,500, 3 weeks delay, 92%
of occurrence, etc. Quantitative analysis principally consists of data gathering and data
treatment. It is often conducted after a qualitative analysis, in order to refine or to validate some
assumptions, because it has a higher cost.
Figure 2 shows several representations of the risk analysis results. The upper ones are the
two-dimensional matrix and diagram of risk probability and impact; the left lower is an
example of radar / Kiviat graph showing criticality of risks; the right lower is a cumulative risk
frequency distribution chart.
- 14 -
Figure 2. Representations of risk analysis results
1.1.2.3 Project risk response planning
The process of risk response planning aims to choose actions in order to reduce global risk
exposure with least cost. It addresses project risks by priority, defining actions and resources,
associated with time and cost parameters. Almost every method mentions the same possible
treatment strategies, including the following:
Avoidance,
Probability or impact reduction (mitigation), including contingency planning,
Transfer, including subcontracting and insurance buying, and
Acceptance.
In the cases when the method includes the opportunity concept, the same strategies exist,
but with opposite names: exploitation, probability or impact enhancement, and risk sharing.
The method of acceptance does not change.
1.1.2.4 Project risk monitoring and control
Risk monitoring and control is, according to the PMBOK®, the ongoing process of
“identifying, analyzing and planning for newly arising risks, keeping track of the identified
risks and those on the watch list, reanalyzing existing risks, monitoring trigger conditions for
contingency plans, monitoring residual risks, and reviewing the execution of risk responses as
well as evaluating their effectiveness” (PMI 2008). It includes six classical techniques and tools:
- 15 -
· Risk assessment: for new risks or for refinement of existing assessments;
· Risk audits: return on investment on the global risk management process;
· Variance and trend analysis: deviations from project plan may indicate potential
threats for the project;
· Technical performance measurement: deviations from planned scope may indicate
potential threats for future delivery and client acceptance;
· Reserve analysis: use of planned contingency reserves is tracked, in order to
determine if the remaining reserves is adequate for the amount of risk remaining;
· Status meetings: project risk management should be an agenda item at periodic
status meetings since it becomes easier the more often it is practiced.
1.2 Increasing complexity of project and associated risks
1.2.1 Complexity of project
According to systems analysis (Penalva 1997; Le Moigne 1990; Boulding 1956), a system
is an object, which, in a given environment, aims at reaching some objectives (teleological
aspect) by doing an activity (functional aspect) while its internal structure (ontological aspect)
evolves through time (genetic aspect) without losing its own identity. Projects can thus be
regarded as systems. Research works on the concept of system complexity have been
conducted for years (L.-A. Vidal et al. 2011a). There are historically two main scientific
approaches of complexity (Schlindwein and Ison 2005). The first one, usually known as the
field of descriptive complexity, considers complexity as an intrinsic property of a system, a
vision which incited researchers to try to quantify or measure it. An example of this vision is
the study by Baccarini (D. Baccarini 1996). He considers project complexity through the
concepts of technological complexity and organizational complexity. He regards them as the
core components of project complexity which he tries to describe exhaustively. The other one,
usually known as the field of perceived complexity, considers complexity as subjective, since
the complexity of a system is improperly understood through the perception of an observer.
Both approaches can apply to project complexity and project management complexity.
The difficulty is that there is actually a lack of consensus on what project complexity
really is. As underlined in (Sinha et al. 2001), “there is no single concept of complexity that can
adequately capture our intuitive notion of what the word ought to mean”. Complexity can be
understood in different ways, not only in different fields but has also different connotations
within the same field (Morel and Ramanujam 1999). Vidal and Marle propose the following
definition of project complexity based on some additional works (D. Baccarini 1996; Edmonds
1999; Marle 2002; Austin et al. 2002; L. Vidal and Marle 2008): “Project complexity is the
property of a project which makes it difficult to understand, foresee and keep under control its
overall behavior, even when given reasonably complete information about the project system.
- 16 -
Its drivers are factors related to project size, project variety, project interdependence and project
context (L.-A. Vidal et al. 2011a, 2011b).” Figure 3 shows an example of project complexity
framework in the study of project complexity. It aims at being a reference for project managers
to identify and characterize some aspects of the project complexity.
Figure 3. An example of project complexity framework (adapted from (L.-A. Vidal et al.
2011b))
- 17 -
As a whole, projects are facing a growing complexity, in both their structure and context.
In addition to the organizational and technical complexities described by Baccarini (D.
Baccarini 1996), project managers have to consider a growing number of parameters (e.g.,
environmental, social, safety, and security) and a growing number of stakeholders, both inside
and outside the project. The existence of numerous and diverse elements which are strongly
interrelated is one of the main characteristics of complexity (Chu et al. 2003; Corbett et al.
2002; Jones and Anderson 2005). Project systems are then in essence complex and this
complexity is undoubtedly a major source of risk, since the project organization may not be
able to cope with it.
1.2.2 Complexity of project risks
With the growing complexity of projects, (i.e., projects are large in terms of size and
stakes; and the structure of projects become more and more complex), an increasing number of
components in the project (e.g., different tasks, different actors and different functions) are
involved in the project management and their dependencies should be taken into account. As a
consequence, the complexity of projects leads to the increasing complexity of project risks
which are associated with the components. Figure 4 describes the relationship between project
complexity and the complexity of project risks.
The complexity of project risks can be represented in terms of a risk network, describing
how risks interact and propagate from one to another. For instance, there might be propagation
from one “upstream” risk to numerous “downstream” risks; on the other side, a “downstream”
risk may arise from the occurrence of several “upstream” risks which may belong to different
categories. In such network, local risk occurrences may trigger global phenomena like the chain
reaction or the “domino effect”.
- 18 -
Figure 4. Complexity vision of project and project risks (Marle 2008)
Another phenomenon is the loop, namely a causal path that leads from the initial
occurrence of an event to the triggering of subsequent consequences until the initial event
occurs once more. An example of loop (shown in Figure 5) is that one initial risk, project
schedule delay, may have an impact on a cost overrun risk, which will influence a technical risk,
and then propagate to and amplify the original risk of schedule delay.
Figure 5. An example of loop phenomenon in risk propagation
- 19 -
Propagation effects throughout the project structure are likely to notably reduce the
performance of the risk management process (Eckert et al. 2004). Particular attention should be
paid to this performance since poor or delayed risk mitigation decisions may have great
potential consequences in terms of crisis, underachievement of objectives and avoidable waste
(Kloss-Grote and Moss 2008). In this regard, we argue that risk propagation behavior should be
modeled and analyzed in the process of project risk management.
1.3 Limitation of current methods for managing real
complexity
Many risk management methodologies and associated tools have been developed, for
example, in (David Baccarini and Archer 2001; Bowles 1998; R. Chapman 2001; C. Chapman
and Ward 2003; Gautier et al. 1997; Henley and Kumamoto 1992; Kaplan et al. 1999;
Kawakita 1991; Keizer et al. 2002; Kerzner 1998; Klein and Cork 1998; Kurtoglu and Tumer
2008; Riek 2001; Shimizu and Noguchi 2005; P. Smith and Merritt 2002; Stamatelatos 2004;
Stone et al. 2004; Tumer and Stone 2001). Some of them have become standards or norms, e.g.,
in (APM 1996; AFNOR 2003; BSI 2002; IEC 1995; IEEE 2001; IPMA 2006; MIL-STD-1629
1998; PMI 2008; PRINCE 1999). As mentioned earlier, they are usually based on the concepts
of probability and impact, assessed qualitatively or quantitatively. Criticality is an aggregate
characteristic used for risk prioritization.
However, many of these methodologies independently evaluate the characteristics of risks,
and focus on analysis of individual risks. Risks are usually listed and ranked by one or more
parameters (David Baccarini and Archer 2001; C. Chapman and Ward 2003; Ebrahimnejad et
al. 2010). For the example in Table 2, common project risk lists exhibit each individual risk and
its category or nature. A two-dimensional Farmer diagram, as shown in Figure 6, can visibly
demonstrate characteristics of risks. We can also cite the creativity-based techniques or the
expertise-based techniques, like expert judgment using Delphi, affinity diagram, peer
interviews or risk diagnosis methodology (Kawakita 1991; Keizer et al. 2002; Kerzner 1998).
Generally, these methods do not take into account the subsequent influence of risks and cannot
represent the interrelation between them.
Table 2. Typical Project Risk List in Classical Methods
No. Risk Title Category
R1 Low budget Cost and time
R2 Law and regulations infractions Contracts
R3 Low communication and advertising User/customer
R4 Unsuitable cast Organization
R5 Unsuitable ticket price setting Strategy
R6 Unsuitable rehearsal management Controlling
R7 Cancellation or delay of the first performance Cost and time
R8 Poor reputation User/customer
… … …
- 20 -
Probability
Impact2 4 6 8 10
0.1
0.5
0.9
0.3
0.7
0
R1
R2
R20
R3
R16 R9
Figure 6. Diagram of risk probability and impact
To comprehensively understand a risk, it is helpful to identify its causes as well as its
effects. Several methods include this principle, but they still concentrate on a single risk for
simplifying the problem (Carr and Tah 2001; Heal and Kunreuther 2007). For instance, Failure
Modes and Effects Analysis (FMEA) consists in a qualitative analysis of dysfunction modes
followed by a quantitative analysis of their effects, in terms of probability and impact (Bowles
1998; MIL-STD-1629 1998); Fault Tree and Cause Tree analyses determine the conditions
which lead to an event and link them through logical connectors in a tree-structure which
clearly displays causes and effects of the particular risk analyzed (Pahl et al. 2007). As the tree
structure shown in Figure 7, although causes and effects of one particular risk could be
displayed, it is still single-risk oriented. Thus, these methods are unable to model complex
interactions among different risks.
R1
R14
R15 R12 R11
R20
Figure 7. Tree structure of risk correlations
Few specific methods are able to model risk correlations with a network structure. For
example, several papers on the application of the Bayesian Belief Betwork (BBN) have
appeared in recent years in the field of project risk management (Fan and Yu 2004; E. Lee et al.
2008; Trucco et al. 2008), which could model risk interrelations, from multiple inputs to
- 21 -
multiple outputs. Figure 8 shows an example of BBN for risk management. Nevertheless, BBN
demands oriented links, is inherently acyclic, and hence does not easily model the loop
phenomenon. This oversight could potentially lead to a disaster in real projects. These methods
are thus not always applicable for practical purpose and fail in some cases to represent the real
complexity of the interdependencies among risks.
Figure 8. An example of Bayesian belief network for risk management in large
engineering project (E. Lee et al. 2008)
Therefore, we conclude that current methods and tools have limitations for modeling the
real complexity of project risks. For this reason, risk propagation behavior cannot be
anticipated and the risk analysis results, such as risk evaluation and risk ranking, are not
reliable. This would influence the subsequent decision-making, e.g., planning risk response
actions.
1.4 Research questions
Due to the previously introduced complexity of project and project risks, associated to the
investigation of limits of current PRM methods, we pose the research questions as follows. The
first question is:
Q0: How to represent the complexity of interdependent risks?
- 22 -
The others are mainly concerning two major steps of PRM: risk analysis and risk response
planning under complexity.
1.4.1 Risk analysis under complexity
Q1.1 What roles the risks act in the network?
Besides individual measure of project risks, their roles in the complex risk network in
terms of the relationship with other risks should also be investigated.
Q1.2 Would risk characteristics be different taking into account propagation?
Because of the propagation behavior in the risk network, the risk characteristics (e.g.,
probability, impact and criticality) might become different from the original estimation by the
project manager in the local point of view. To answer this question, this aspect of risk analysis
should be conducted and calculated quantitatively.
Q1.3 Should we update the risk prioritization?
Depending on the first and second research questions, if risks play an unexpected role in
the context of network and/or the re-evaluation of risk characteristics has changed, the risk
prioritization should be adjusted correspondingly. This potential update will change the
subsequent decision-makings.
1.4.2 Risk response planning under complexity
Q2.1 Should we redesign response actions based on the refined analysis results?
Risk response actions are designed based on the risk analysis results. The update of risk
analysis results will certainly provide the project manager with new insights on risks and their
relationships. This would help them design more targeted and hence more effective response
actions.
Q2.2 Would the actions’ global effects be different from what we expected after propagation?
The consequence of occurred risks will potentially propagate through the risk network.
Thus, the effects of implemented actions, which are designed for mitigating the exposure of one
or several risks, may also propagate through the network to impact other risks. The global
effects of risk mitigation actions will be anticipated and tested in the developed network model.
Q2.3 How to allocate scarce resources under constraints?
Project manager face a challenge to allocate limited resources for managing a number of
identified risks. In this regard, practical methods should be developed to help project manager
optimize the risk response plan under constraints.
- 23 -
1.5 Research approach
To answer and find solutions to the posed research questions, a novel integrated decision
support system, based on the classical PRM process, is proposed with a series of methods and
tools. Two case studies on real projects are used for illustrating the application of the approach.
1.5.1 A new integrated decision support system for PRM
In order to manage a project with interdependent risks, it is mandatory to bring the
modeling of risk interactions into the PRM process. Risk interactions should be modeled with a
network structure instead of a classical list or tree structure for representing the real complexity
of the project. Certainly, this involves using classical risk characteristics like probability and
impact as inputs for this network (the nodes for individual risks).
We only consider negative risks in the scope of this study. The objectives of project risk
management are thus to decrease the probability and impact of negative risks in the project.
With the purpose of managing the complexity of project risks and based on the classical
process of project risk management, we present an original framework of decision support
system (DSS) for PRM.
This DSS includes five phases:
(1) risk network identification;
(2) risk network assessment;
(3) risk network analysis;
(4) risk response planning; and
(5) risk monitoring and control.
Figure 9 illustrates this framework. The innovative steps based on the classical risk
management process and the new generated outcomes are highlighted in the figure.
In phase (1), potential project risks are identified by classical methods and the result is a
project risk list. Based on this list, risk interactions are identified and represented using a
matrix-based method. In phase (2) of the risk network assessment, the probability and impact of
identified risks are evaluated by classical methods; then the strength of risk interactions is
assessed directly by experts or through pairwise comparisons, in terms of the cause-effect
probability between risks. In addition to project risks, the identification and evaluation of risk
interactions makes it possible to construct the project risk network.
In phase (3), one innovation of this framework is to introduce complementary methods to
the classical ones to evaluate and prioritize individual risks. A network theory-based topological
analysis is conducted to identify key factors (risks and risk interactions) with respect to their
roles in the risk network. The originality is to apply network analysis in the context of project
risk management, and particularly to tailor some network theory indicators, including
- 24 -
connectivity indicators, interface indicators and betweenness centrality. Besides, an
eigenstructure analysis is adapted and performed based on both the topological structure of risk
network and the weighted risk network, with the goal of measuring the importance of risks with
respect to their position in the network. This measurement reflects the influence of a risk
taking into account both its direct and indirect connections with the other risks in the network.
Furthermore, the risk network can be modeled and run in a discrete-event simulation context.
This enables an analysis of the propagation behavior in the network and thus a re-evaluation of
risks considering their correlations. In addition, a matrix-based risk propagation model is
developed to quantitatively calculate risk propagation and to re-evaluate risk characteristics for
updating the risk prioritization. These innovative analyses serve as a powerful complement to
classical project risk analysis. The outcomes of phase (3) provide project managers with re-
evaluation and new insights on risks and risk interactions for supporting subsequent decision-
making.
The response planning phase (4) consists of several activities: (a) potential mitigation
actions are identified using the previous analyses, and they are preliminarily evaluated by
experts (some unfeasible actions can be screened out through this activity); (b) candidate
actions are tested in the risk network model for estimating their effects on a specific target or on
the global risk network, i.e., the level of residual risks that is expected to remain after the
implementation of these actions; and (c) under the identified resource constraints for
conducting risk management, optimization algorithms can be developed and used to obtain an
optimal portfolio of mitigation actions. Then, the project manager makes decisions about the
risk response plan suggested by the DSS.
Finally in phase (5), the evolution of the risk network is monitored and the effectiveness of
the actions is evaluated to keep the project under control. The phase of monitoring and control
provides feedback for the previous phases, which allows the modification and improvement of
their results.
This decision support system for project risk management is a cooperative DSS (Gachet
and Haettenschwiler 2003; Adla et al. 2007; Bui and Lee 1999). Decision-makers (usually the
project manager and the team of experts) are allowed to modify, complete, and refine the
managerial suggestions proposed by the system. Their involvement is also required in each
phase of the DSS to provide their knowledge, expertise and experience.
The mapping relationship between corresponding steps in the framework and the research
questions put forward in Section 1.4 are shown in Figure 10. The following chapters will
provide more details of the methods or tools which are used or developed for each phase of the
PRM framework.
25
Figure 9. Framework of the decision support system for PRM
26
Figure 10. Steps in the DSS for addressing related research questions
- 27 -
1.5.2 Case studies
We apply and test this framework to two real projects. These case studies are used for
illustration and validation of the proposed approach. The first one is a project in the
entertainment industry of staging a musical play. The second one is an industrial project for
implementing a tramway transportation system. These two case studies have different size in
terms of identified risk numbers and different level of complexity in terms of risk interactions.
The introduction and analysis results of the applications will be discussed in the following
chapters.
1.6 Conclusion
This chapter discusses the background and research problem of the Ph.D. study. A brief
introduction to project management and the classical process of project risk management is
given. Unexpected conditions or planning errors may lead to delays, over-costs and other
failures which can undermine the successful realization of the project. We refer to such events
or conditions as project risks. This study mainly focuses on the conventional risks with negative
effects.
The issue of growing project complexity is discussed. The associated complexity of
project risks may undermine the effectiveness of project risk management. A literature review
demonstrates that existing methods and tools have limitations for modeling the real complexity
of project risks. For example, some propagation phenomena like chain reactions and loops are
not properly taken into account. In this regard, research questions are posed mainly focusing on
how to represent the complexity of project risk, risk analysis and risk response planning taking
into account this complexity. To address these research questions, we propose an integrated
decision support system framework, which enables the project manager to model and analyze
the complex risk network. The aim is to support decision-makers in planning risk response
actions with a structured and repeatable approach.
The details of the decision support system will be introduced in the following chapters.
Chapter 2 describes the process of building the project risk network. Chapter 3 presents a
prototype of simulation-based risk network model for decision support in PRM. In Chapter 3, a
network theory-based topological analysis and an eigenstructure analysis are developed for
analyzing structural properties in the risk network. Chapter 5 introduces a matrix-based risk
propagation model and adapts the eigenstructure analysis on weighted risk network. In Chapter
6, a genetic algorithm-based model is developed for optimizing the risk response plan and it is
compared with a greedy algorithm. Chapter 7 concludes the thesis and discusses the perspective
on the future work.
- 28 -
- 29 -
Chapter 2 - Project Risk Network Modeling
Abstract
The overall purpose of this chapter is to propose an approach with available and useful
tools for building the interactions-based project risk network. As discussed in Chapter 1, the
existing methods in project risk management are not able to appropriately represent and model
the real complexity of project and its underlying risks. Through modeling the interrelationship
between project risks in the network structure, it permits us to conduct subsequent risk network
analyses for analyzing the risk propagation behavior. The results can thus improve the project
manager’s insights for making decisions concerning risk management.
First, similar to the traditional project risk management, individual project risks are
identified and their characteristics are assessed in terms of probability and impact. Based on the
resulting project risk list, potential risk interactions are identified thanks to the use of Design
Structure Matrix (DSM) tool. The strength of risk interactions can be assessed directly by
experts or through a developed AHP-based algorithm. The obtained Risk Structure Matrix
(RSM) and Risk Numerical Matrix (RNM) represent the risk network structure and the
measurement of its edges (regarded as the transition probability between risks).
An application to a real project in the entertainment industry is provided to test and
illustrate the approach. Some conclusions are drawn and some uncertainties in the modeling
process are discussed.
Chapter Keywords
Risk interaction, risk network, design structure matrix (DSM), risk structure matrix (RSM),
analytic hierarchy process (AHP), risk numerical matrix (RNM)
- 30 -
2.1 Building the risk network structure
As mentioned in Chapter 1, project managers are facing a growing complexity of project
and interdependent risks. In order to understand and manage this complexity, project risk
network needs to be built by modeling project risks and their interactions. The project risk
network is a directed network and consisted of risks and risk interactions. Project risks are
identified and represented as the nodes, and their potential interactions are directed edges in the
network.
2.1.1 Identification of project risks
In order to establish and analyze the risk network of project, it is necessary to identify
individual risks firstly. Risk identification is the process of determining which risks may
potentially affect the project and documenting them for the next step of analysis. There are a
number of classical methods for identifying individual project risks based on analogy (P. Smith
and Merritt 2002; Riek 2001), on heuristics (R. Chapman 2001; Kerzner 1998) or analytically
(Stamatelatos 2004; Shimizu and Noguchi 2005; L. Lee et al. 2007).
With the help of expertise and / or experience, we can identify risks which, for example,
may occur during every phase, or in every department of the project. As described in PMBOK
(PMI 2008), the following information or documents can be used as the inputs for identifying
project risks:
· Risk management plan
· Activity cost estimates
· Activity duration estimates
· Scope baseline
· Stakeholder register
· Cost management plan
· Schedule management plan
· Quality management plan
· Project documents
· Enterprise environmental factors
· Organizational process assets
In our study, classical tools and techniques in project risk management such as
documentation reviews, brainstorming, interviewing, and checklist analysis are used to identify
project risks. The output of risk identification is a conventional project risk list.
- 31 -
2.1.2 Identification of risk interactions
Identification is the first step of determining the dependency relationship between the
identified risks. The nature of risk interactions can be classified into several categories.
Research on this subject has appeared in several papers, for example, ALOE model developed
by Vidal and Marle (L. Vidal and Marle 2008) defines different kinds of relationship of links
between project risks:
· Hierarchical link
· Contribution link
· Sequential link
· Influence link
· Exchange link
Several links with different natures might exist between two risks. They are all expressed
with potential cause-effect relation in this study.
2.1.2.1 Basics of the DSM tool for modeling interdependencies
The Design Structure Matrix (DSM) method, which is also known as the dependency
structure matrix or dependency structure method, was introduced by Steward (Steward 1981)
for tasks-based system modeling and was initially used essentially for planning issues
(Eppinger et al. 1992). Ever since then, it has been widely used for modeling the relationship
between other types of objects, for example, product components, projects, people and
activities (Browning 2001; Sosa 2008; Sosa et al. 2004; Eppinger and Salminen 2001;
Danilovic and Browning 2007). A DSM is used to relate entities of one kind to each other, for
example, the tasks that constitute a complete project. It can be used to identify appropriate
teams, work groups, and an ideal sequence of how the tasks can be arranged.
Figure 11 displays a typical form of DSM. A DSM is a square matrix, i.e., it has an equal
number of rows and columns. The labels both in rows and columns correspond to the finite
number of elements in the system. Each cell in the matrix represents the directed dependency
between the related elements in the system. If a DSM is defined to allow the self-loop (an
element is directly linked to itself), the self-linked relationship should appear in the diagonal
cells. A DSM could be binary (only indicates the existence of dependencies) or numerical (also
shows the weighted measurement of dependencies).
- 32 -
Figure 11. Illustration of DSM (DSM-Community 2009).
A procedure is proposed by Dong (Dong 2002) for building a credible DSM. The basic
steps include:
1) Define the system and its scope
2) List all the system elements
3) Study the information flow between system elements
4) Complete the matrix to represent the information flow
5) Give the matrix to the engineers and managers to comment on and use
The DSM has proven to be a practical tool for representing and analyzing relations and
dependencies among system components. It provides a concise and simple way to compactly
and visually represent a complex system with a large number of elements which are interrelated.
In order to develop our approach of integrating complexity modeling into project risk
management, we use the DSM for building the project risk network. This is presented in the
following paragraphs.
2.1.2.2 Identifying and representing risk interactions in Risk Structure
Matrix (RSM)
For our study, we use the concept of DSM with risks, in the context of project
management. The interrelations between project objects such as tasks, actors and product
components facilitate identifying the interrelations between the risks related to these objects.
For instance, the project schedule gives information about task-task sequence relationships.
This helps to identify the correlation between two risks of delay for these tasks. A component-
component relationship (functional, structural or physical) means that the risks, which may be
related to product functions, quality, delay or cost, can be linked, since one problem on one
component may have an influence on another (e.g., budget limits). In a similar way, the domain
mapping matrix (DMM) introduced by Danilovic and Browning (Danilovic and Browning 2007)
- 33 -
and the multiple-domain matrix (MDM) introduced by Lindemann, Maurer and Braun
(Lindemann et al. 2008) are helpful in identifying risk interactions across different domains of
the project.
Risk interaction is considered as the existence of a possible precedence relationship
between two risks. We define the Risk Structure Matrix (RSM), which is a binary and square
matrix with RSMij = 1 when there is a link from Rj to Ri. It does not address concerns about the
probability or impact assessment of this interaction. We put a sanity check between Ri and Rj.
Suppose we know that Ri declared Rj as a cause, if Rj did not declare Ri as a consequence, then
there is a mismatch. Each mismatch is studied and solved, like the analogous works by Sosa
about the interactions between project actors (Sosa et al. 2004). Figure 12 gives an example to
show the use of such a RSM to represent the risk network.
Figure 12. Illustration of risk structure matrix (RSM)
As we can see, the RSM permits to express the correlations of project risks in the built risk
network structure. According to Thompson’s study on relationships in the organizational
structure (Thompson 1967), there are three basic types of relationships between each pair of
risks:
· Dependent: risks are engaged in a potential precedence relationship.
· Interdependent: risks are engaged in a mutually dependent relation, directly or
within a bigger loop.
· Independent: risks are not related.
A fourth type of activity relationship – contingent is introduced by Browning in (Browning
2001).
The DSM tool also enables some powerful analyses on RSM, e.g., partitioning, tearing,
banding and clustering (Browning 2001; Gunawan and Ahsan 2010; W. T. Lee et al. 2010).
- 34 -
However, these matrix theory-based analyses are not in the overall scope of this PhD thesis,
which mainly concerns risk propagation modeling and analysis in the network.
2.2 Assessment of the risk network
In the assessment phase, the risk network parameters are evaluated. Project risk
characteristics such as risk impact and risk probability are evaluated using classical methods in
project risk management. The strength of risk interactions (edges in the risk network) is also
assessed and regarded as the transition probability between risks.
2.2.1 Project risk assessment
2.2.1.1 Risk assessment in terms of probability
For the probability assessment, we make a distinction between the probability of a risk to
be triggered by another risk inside the network and its probability caused by external events or
risks which are outside the system. Spontaneous probability can be interpreted as the evaluated
likelihood of a risk, which is not the effect from any other activated risks inside the system. For
the example in Figure 12, Risk 5 occurs only in accordance with its spontaneous probability;
and Risk 6 may arise from both its spontaneous probability and the transition probability
between Risk 5 and Risk 6.
Qualitative scales are often used to express probability with 5 to 10 levels (e.g., very rare,
rare, unlikely, etc.) which correspond to non-linear probability measures (e.g., 10-4
, 10-3
, 10-2
,
etc.). Logarithmic scales have been used by statisticians for several decades (Fleiss 1981). They
allow us to distribute probabilities unevenly. In practice, they devote more space to small
values, imposing a compressed, logarithmic mapping. Based on this principle, we can use, for
example, Equation (1) for converting qualitative scales into quantitative measures of risk
spontaneous probability:
( )
10 spb
a-
= * (1)
where p indicates the quantitative probability measure, s indicates the qualitative scale value,
with parameters 0, 0a b> > . The parameters a and b are case-dependent. They are obtained
by setting the mapping relationship between the qualitative scale and quantitative probabilities,
namely the ceiling of probability of risk occurrence is predefined. For example, for some
regular engineering projects, the project risks like schedule delay and cost overrun are usually
encountered, thus the probability of them is relatively higher. In this manner, we may set the
highest scale ‘9’ which corresponds to for instance 40% of occurrence. While for some critical
projects like nuclear engineering, the estimation of highest probability of risk occurrence is
normally much lower. In the two case studies used in this thesis (a musical staging project and a
tramway construction project) applies the former situation.
- 35 -
2.2.1.2 Risk assessment in terms of impact
Risk impact assessment investigates the potential effect of the occurrence of the risk on the
project objective such as schedule, cost, or quality. We mainly focus on negative effects for
threats in this work.
Risk impact can be assessed on a qualitative scale (e.g., ordinal or cardinal scale with 5 or
10 levels) or on a quantitative scale (e.g., financial loss). In this study, we use classical methods
for the impact assessment, based upon a mix of previous experience and expert judgment.
2.2.2 Risk interactions assessment
A numerical structure matrix can provide more detailed information than a binary one
about the risk network for assisting decision-making. Assessment is the process of measuring
and estimating the strength of the link between risks. Two ways can be used for the estimation:
direct assessment and relative assessment. In this section we describe the methods used in this
study for assessing the strength of risk interactions.
2.2.2.1 Direct assessment by experts
Based on the established RSM, the weight of each non-zero element in the matrix
(identified potential risk interaction) can be assessed during the interviews or meeting with the
project manager and/or related experts involved.
Direct assessment is made for each potential interaction by one or more experts according
to their experience and/or expertise. In the process of assessment, different experts may get
outcomes with differences. To moderate this kind of confusion and divergence, particular
experts are asked to be responsible for several rows and columns in the RSM according to their
specialty. Finally, the assessment results from different experts need to be combined and
consolidated.
2.2.2.2 Relative assessment based on pairwise comparison
Relative assessment consists in comparing the causes (or the effects) of a single risk which
has multiple interactions. This involves using the principle of pairwise comparisons in the
Analytic Hierarchy Process (AHP). The AHP developed by Saaty is a multi-criteria decision-
making method based both on mathematics and human psychology (Saaty 1977, 1980 2000,
2003). It notably permits the relative assessment and prioritization of alternatives. The AHP is
based on the use of pairwise comparisons, which lead to the elaboration of a ratio scale.
An AHP-based assessment has been developed by Marle and Vidal to obtain the numerical
values of the strength of risk interactions (Marle et al. 2010). The main principles are
introduced in the next paragraphs and displayed in Figure 13:
- 36 -
Step 1: Decomposing individual sub-problems
For each risk Ri, we isolate the risks which are related with Ri in column (possible effects)
and in row (possible causes). This identification enables one to generate the Binary Cause (or
Effect) Vectors, with regard to risk Ri, respectively called BCV|Ri and BEV|Ri.
Step 2: Evaluating the relative strength
We build up two matrices (Cause or Effect Comparison Matrices) with regard to one risk
Ri (respectively CCM|Ri and ECM|Ri). The AHP is based on the use of pairwise comparisons,
which lead to the elaboration of a ratio scale. In our case, we have two parallel pairwise
comparison processes to run. The first one consists in the ranking in rows for each project risk.
The criterion according to which the alternatives are evaluated is the contribution to Ri in terms
of risk input. In other words, for every pair of risks which are compared, Rj and Rk (thus
following RSMij=RSMik=1), the user should assess which one is more important to risk Ri in
terms of the probability of triggering Ri. These assessments are expressed by numerical values
thanks to the use of traditional AHP scales. The second one is the ranking in columns,
according to the same principles.
Step 3: Calculating the eigenstructures
Eigenvectors of each matrix ECM|Ri and CCM|Ri are now calculated. It enables one to
find the principal eigenvectors, corresponding to the maximal eigenvalue. They are called
Numerical Cause or Effect Vectors and are relative to one risk Ri (NCVi and NEVi). The
consistency of the results should be tested thanks to the AHP consistency index.
Step 4: Aggregating the eigenvectors
For each risk Ri, Numerical Cause or Effect vectors (NCV and NEV) are respectively
aggregated into Numerical Cause or Effect Matrices (NCM and NEM). The i-th row of NEM
corresponds to the eigenvector of CCM|Ri which is associated to its maximum eigenvalue. The
j-th column of NCM corresponds to the eigenvector of ECM|Rj which is associated to its
maximum eigenvalue.
Step 5: Compiling the results
The two previous matrices are aggregated into a single Risk Numerical Matrix (RNM), the
values of which assess the relative strength of local interactions. The RNM is defined by a
geometrical weighting operation in Equation (2) (based on the assumption that both estimations
in terms of cause and effect can be considered equivalent). We choose the geometrical mean
rather than arithmetic mean because it tends to favor balanced values (between the two
assessments). RNMij is defined as the strength of the cause and effect interaction from Rj to Ri.
( , ) ( , ) ( , ), ( , ),0 ( , ) 1RNM i j NCM i j NEM i j i j RNM i j= ´ " £ £ (2)
- 37 -
Figure 13. Description of the transformation process from RSM to RNM
The RNM thus permits to synthesize the existence and strength of local precedence
relationships between risks, as it combines the cause-oriented vision and the consequence-
oriented vision of an interaction. This is helpful to avoid any bias or misevaluation which can
happen when looking at the problem with single vision.
RNM is a square matrix with identical rows and columns. The risks in column labels are
causes while the ones in row are effects. An off-diagonal value signifies the strength of the link
between two risks. In the risk network model, numerical values of cause-effect interactions in
the RNM can also be interpreted as the transition probability between risks. For example, if the
element RNM (4,3) is equal to 0.25, then the probability of Risk 4 originating from Risk 3 is
considered to be 25% under the condition that risk 3 is activated.
2.3 Case study
2.3.1 Introduction to the case study
We illustrate the proposed method of project risk network modeling to a project of staging
a musical play in the entertainment industry. The project is the production of a family musical
show in Paris, France, including costumes, lightning and sound design, casting management,
rehearsal management, fund raising and overall project management. The duration of the
project is 15 months and the team is composed of 18 people, plus the actors and actresses.
- 38 -
The first action of case study consisted in interviewing the persons directly involved in the
project risk management process, namely the risk owners and the project manager. These
participants were given a short background questionnaire on their experience in the
organization and in this kind of project. They were also given a presentation of the method,
including the analysis that will be made using the input data they were going to provide. To
avoid potential differences among interviewers and their interviewing techniques, only one
interviewer was used for all the interviews. Through the interviews and meetings we were able
to perform the identification and assessment of risks and risk interactions. During the final
meeting, the evaluations were exposed and discussed by all the participants. Some changes
were made during the discussion and a consensus was reached at the meeting, which lasted
about three hours. As a whole, three weeks were needed to build up the assessed project risk
network.
2.3.2 Results
Working with the project management team on the steps of identifying and evaluating
individual project risks, we acquire the original project risk list, shown in Table 3. The list
comprises 20 identified risks at the main level which may occur and affect the delivery of the
project. The risk ID, risk name, and their characteristics such as nature/domain, risk probability,
risk impact and risk criticality are displayed in the list.
As we can see, the identified risks are categorized into different domains according to their
nature. For instance, “Cost and time” risks such as R01 (Low budget) and R07 (Cancellation or
delay of the first performance) are closely related to the project objectives like cost or schedule;
“Controlling” risks such as R06 (Unsuitable rehearsal management), R19 (Low creative team
leadership) and R20 (Low creative team reactivity) are mainly the responsibility of the project
management team; and so on.
The assessment of individual risks is performed using the 10-level qualitative scale, both
for risk probability and risk impact. Criticality of the risk is classified into different levels (e.g.,
negligible, acceptable and unacceptable) according to the product value of its evaluated
probability and impact.
- 39 -
Table 3. Original project risk list with characteristic values of the musical staging project
ID Risk Name Nature/Domain Criticality Probability Impact P*I R01 Low budget Cost and time Unacceptable 8 7 56
R02 Law and regulations
infractions Contracts Unacceptable 7 5 35
R03 Low communication and
advertising for the show User/customer Unacceptable 8 9 72
R04 Unsuitable cast Organization Unacceptable 5 9 45
R05 Unsuitable ticket price
setting Strategy Unacceptable 7 6 42
R06 Unsuitable rehearsal
management Controlling Acceptable 3 8 24
R07 Cancellation or delay of the
first performance Cost and time Unacceptable 5 8 40
R08 Poor reputation User/customer Acceptable 3 7 21
R09 Lack of production teams
organization Organization Acceptable 4 6 24
R10 Low team communication Organization Acceptable 3 6 18
R11 Bad scenic, lightning and
sound design
Technical
performance Negligible 2 7 14
R12 Bad costume design Technical
performance Acceptable 3 8 24
R13 Low complicity between cast
members
Technical
performance Acceptable 3 7 21
R14
Too ambitious artistic
demands compared to
project means
Requirements Acceptable 7 2 14
R15 Few spectators / Lukewarm
reception of the show User/customer Acceptable 2 9 18
R16 Technical problems during a
performance
Technical
performance Acceptable 4 5 20
R17 Low cast motivation Organization Negligible 2 4 8
R18
Childish direction
(unsuitable for family
audiences)
Strategy Negligible 2 5 10
R19 Low creative team
leadership Controlling Unacceptable 3 10 30
R20 Low creative team reactivity Controlling Negligible 2 2 4
The resulting project risk list with classical methods in PRM serves as an input for
studying risk interactions so that we are able to build the project risk network. Thanks to the
expertise and experience of the project manager and the team of experts, and using the DSM
tool, the RSM of the project is built and shown in Figure 14. The RSM corresponds to the
project risk network structure, displayed in Figure 15. The project risk network is a complex
network with interdependent risks. A risk could have multiple input links and multiple output
links. There might be several different paths from one risk to another.
- 40 -
Figure 14. RSM of the musical staging project
Figure 15. Interactions-based project risk network structure of the musical staging
project
The strength of risk interactions is assessed using a developed AHP-based method, as
described in Section 2.2.2. Due to the high level of expertise of interviewees, this step was done
quite quickly (for several hours, including the interviews and two meetings). In order to get the
spontaneous probability, they supposed that none of the identified cause risks would take place
and then they were asked: “what is the remaining probability of this event to occur?”
- 41 -
Qualitative probability is converted into numerical probability through Equation (1):
( )
10 spb
a-
= * , where the parameters are set as 5, 8a b= = by experience.
The only difficulty was that it appeared easier for the risk owners to consider the
interactions with causes that could affect them, than to consider the interactions with effects of
their own actions and decisions. But this potential bias was fixed by the meetings and the
simultaneous presence of the different correlated owners. This approach enabled us to get the
consistency on both the existence and the assessment of each interaction, because the two
involved owners (respectively for the cause and effect risks) were present.
Figure 16 displays the RNM with evaluated transition probability of the risk interactions.
For instance, in the (7, 11)-th item of the matrix, the value 0.327 denotes that the transition
probability from risk 11 (Bad scenic, lightning and sound design) to risk 7 (Cancellation or
delay of the first performance) is 32.7%.
Figure 16. RNM of the musical staging project
2.4 Conclusions
As a whole, this chapter presents the innovative process of building the project risk
network through risk interactions modeling (addressing the research question Q0). Classical
techniques in project risk management and some sophisticated tools such as DSM and AHP are
exploited to carry out the modeling process. Based on the resulting project risk network,
subsequent analyses can be performed in order to study the risk propagation behavior in the
network.
The whole process of project risk network modeling is tested and applied to a real project
of musical staging. The generated outcomes are a conventional project risk list and the project
risk network (or the equivalent RNM). This case study will also be used for illustration in
several of the succeeding chapters.
- 42 -
However, during the steps of identification and assessment, there might be uncertainties.
For example, in every identification process of risk interactions, there is a limit to the scope
when considering risks inside or outside the project risk list. Downstream limits are generally
the final expected project results. They may include immediate results like profit, delivery time
or post-project results related to operation, maintenance or recycling phase. Upstream limits are
generally decided depending on the influence or capacity of actions that the decision-makers
have on these causes. The identification of risk interactions has been done on direct cause or
effect relationship. In the end, the aggregation of local cause-effect relationships made it
possible to display the global project risk network. This permitted us to organize a meeting
where the interviewees had the possibility to add or remove nodes and edges in the risk
network.
In the assessment steps, even with a mix of individual and collective work, misjudgments
are possible and the estimations remain uncertain or unreliable. This is all the more true that we
are not in a context with lots of experience, where estimations could be considered as quite
reliable. This is why we decided to run a sensitivity analysis in the following step of risk
network analysis, in order to consider the uncertainties on the inputs and their influence on the
outputs. A preliminary work on this concern will be detailed in Section 3.2, Chapter 3.
- 43 -
Chapter 3 - A Simulation-Based Risk Network
Model for Decision Support in PRM
Abstract
This chapter presents a risk network model as a decision support system (DSS) for project
risk management. Existing classical PRM methods have limitations for modeling the
complexity of project risks. Hence, some propagation phenomena like chain reactions and
loops are not properly taken into account. This will influence the effectiveness of decisions for
risk response planning and will lead to unexpected and undesired behavior in the project. An
effort has been made in Chapter 2 to model project risks and their interdependencies into a risk
network. The study in this chapter aims at analyzing behaviors like risk propagation in the built
risk network and help project manager make more reliable decisions.
Simulation technique is used to run the risk network model and to imitate the occurrence
of risks and risk propagation behavior. This enables us to re-evaluate risks in terms of different
characteristics, to update the risk prioritization results, and to suggest and test risk mitigation
actions. Thus, the risk network model can support project manager in making decisions with
respect to risk response actions.
An application to the previously introduced real musical staging project is provided to
illustrate the utility of the model. A preliminary sensitivity analysis is conducted to examine the
effects of input uncertainties on the analysis results. Several examples of mitigation actions are
tested in the prototype model to demonstrate the effectiveness of this decision support system.
Finally some conclusions are drawn about the proposed risk network model and the case study.
Chapter Keywords
Risk propagation, risk network analysis, simulation, sensitivity analysis, risk mitigation,
decision support system
- 44 -
3.1 Brief description of the simulation model
In the context of project management, it is costly and unfeasible to carry out concrete
experimental studies on projects. In this sense, simulation is an alternative tool for empirical
research in decision support systems (Arnott and Pervan 2008). Computer simulation refers to
methods for studying a wide variety of models of real-world systems by numerical evaluation.
It is achieved using computer software designed to imitate the system’s operations or
characteristics, often over time. Nowadays, simulation has become more popular and powerful
than ever since computer and software technologies have significantly developed. Simulation
techniques are widely used to build model-driven decision support systems (Power and Sharda
2007). They assist decision-maker in anticipating the effects of events, actions and resource
allocations by assessing their potential consequences. Therefore, in this research, we apply
simulation technique to model and analyze the project risk network.
Project risks and their identified dependency relationships are modeled with network
structure by simulation. Parameters of the simulation model include spontaneous probability of
each risk and transition probability of each interaction link, the concepts of which have been
introduced in Chapter 2. During the simulation, a risk may occur randomly on the basis of its
assessed spontaneous probability; it can be triggered by one of its predecessor risks according
to a given transition probability; and it can also activate the successor risks in the network. In
the running process of the risk network model, each iteration is to simulate one operation of the
real project. The occurrence of every risk is recorded during the simulation thanks to statistical
accumulators deployed in the model.
Modeling risk interactions by simulation enables us to analyze the propagation behavior in
the risk network. A large number of iterations are conducted for each scenario of simulation.
The simulation results can be analyzed to support decision-making for risk management.
3.2 Applications to support managerial decision-making
This section presents an analysis of the project risk network (Section 3.2.1) based on the
simulation model described in Section 3.1. The results of this analysis help the project manager
make decisions about risk mitigation actions (Section 3.2.2). Finally, the risks and the effects of
actions are monitored for keeping the project under control (Section 3.2.3).
3.2.1 Risk network analysis
More than analyzing individual project risks in terms of the estimation of their probability
and impact, modeling risk interdependencies enables us to analyze risk propagation in the
network context. In this respect, project risks should be re-evaluated taking into account the
propagation behavior through risk interactions. The risk prioritization results like risk ranking
may change in the risk network analysis, which may affect the following step of risk response
- 45 -
planning. Sensitivity analysis is helpful in examining and mitigating the effects of uncertainties
in the previous assessment phase.
3.2.1.1 Risk re-evaluation
Risks can be re-evaluated in terms of different characteristics. The definition and
calculation of these characteristics are described as follows.
1) Re-evaluation of risk frequency
After taking into account the risk propagation behavior, risk probability can be re-
evaluated and expressed as statistical risk frequency in the simulation. In practice, a risk may
occur more than once during one replicate of the project simulation. This is consistent with the
real-life situations. Simulated frequency represents the average occurrence of a risk during the
project, which may be greater than 1. The relationship between simulated risk frequency and
risk probability is expressed in Equation (3):
1 2 3
1
[ ] ( ) 2 ( ) 3 ( ) ... lim ( )m
i i i k im
k
RF i P R P R P R k P R®¥
=
= + × + × + = ×å (3)
where RF[i] indicates the simulated risk frequency of Ri, and Pk(Ri) indicates the probability of
Ri occurring k times during the project.
The statistics of risk frequency can be obtained during the simulation process.
2) Anticipation of risk consequences
The simulation model can also be used to anticipate the consequences of one particular
risk or a certain scenario. We simulate the scenario by setting the appointed spontaneous
probability of related risks, and then all the potential consequences of this scenario can be
observed after simulation. For example, if we assign 100% spontaneous probability to one risk
while all the other risks have the value of 0%, then the simulation shows both its direct and
indirect impacts on other risks in the network. The consequences of a risk are defined in
Equation (4) for re-evaluating its impact in the global scope:
1
[ ] [ ] [ ]n
i
j
CR i RF j RI j=
= ×å (4)
Here CR[i] is the consequences of Ri, and RFi[j] indicates the simulated risk frequency of
Rj originating from Ri. RI[j] is the evaluated risk impact of Rj, which may be expressed on
qualitative or quantitative scales.
3) Re-evaluation of risk criticality
As introduced in Chapter 1, risk criticality is generally a combination of probability and
impact, or is simply defined as the product of them. The local criticality of a risk can be re-
evaluated by multiplying its simulated frequency and its local evaluated impact, as in the
following equation:
[ ] [ ] [ ]LC i RF i RI i= × (5)
- 46 -
In a similar way, we can refine the estimation of risk criticality by incorporating all the
consequences of the risk in the network. The simulated global criticality of Ri is defined by
Equation (6):
[ ] [ ] [ ]GC i RF i CR i= × (6)
3.2.1.2 Risk prioritization
In the process of PRM, risk prioritization or risk ranking is relied on to plan response
actions. Risks must be prioritized because no project has enough resources to mitigate every
potential risk. Project manager therefore needs to know which risks pose greatest threat to the
project success and concentrate their effort on those higher risks (David Baccarini and Archer
2001).
In classical methods, risks are prioritized according to their evaluated probability and
impact. In this risk network model, we simulate risk propagation behavior to obtain several
different indicators for risk prioritization, such as the refined risk frequency and criticality. The
prioritization results based on the re-evaluated indicators provide the project manager with a
new understanding of risks and their relative severity in the project. The shift of risk
prioritization results also influence the planning of mitigation actions.
3.2.1.3 Sensitivity analysis
Uncertainties exist in the assessment phase of evaluating risks and risk interactions. The
reliability of analysis results therefore needs to be considered. Sensitivity analysis regards the
study of the behavior of a model to ascertain how much its outputs depend on the input
parameters (Saltelli et al. 2000). In this respect, sensitivity analysis is performed to examine the
effects of input uncertainties on the outputs.
An effort is made to conduct a preliminary sensitivity analysis in this study. For example,
we evaluate risks with three-level spontaneous probabilities (optimistic, most likely, and
pessimistic value). Depending on the varying input values, the corresponding criticality of each
risk is obtained. Sensitivity analysis is a useful tool of decision support system to verify the
final ranking of the alternatives (Mészáros and Rapcsák 1996). It helps to enhance the
robustness of the system and the reliability of its managerial suggestions.
3.2.2 Mitigation actions planning and test
In project risk management, mitigation is an important and common treatment strategy to
reduce local or global risk exposure. Taking early action to reduce the probability and/or impact
of a risk occurring on the project is often more effective than trying to repair the damage after
the risk has occurred (PMI 2008). In classical methods, courses of action are carried out on
risks having the highest ranking or priority, in other words, on risks with the highest criticality.
These actions are in practice, for instance, internal or external communication actions, training
of members, buying additional or superior material resources, choosing a cheaper, more stable
- 47 -
or closer supplier, or increasing the number of tests. Mitigation actions always consume time,
money and resources. It requires a leader, or at least one project member accountable for them.
They should be included in the project plan like every action contributing to the delivery of the
project result.
Based on the simulation analysis of the risk network, we get the risk re-evaluation and
updated prioritization results. Hence, a new risk response plan can be developed. The new
actions include: (1) classical mitigation actions, but applied to risks with re-evaluated values
and rankings (simulated values may be different from initial estimations); (2) non-classical
mitigation actions, which mitigate risk propagation instead of risk occurrence. Strategies for
mitigating risks in different categories are likely to be different. For example, risks without any
input while leading to many outputs are likely to be source risks; risks with many inputs as well
as many outputs can be considered as transition risks in a project; risks without output are
accumulation risks, often related to project performance like schedule, cost or quality. In
addition to the scope of local target on one or several specific risks, mitigation actions could
also be proposed to achieve global effects on the risk network.
Simulation can be used to show the eventual effects of alternative conditions and courses
of action (Rozinat et al. 2009). In our simulation-based risk network model, different kinds of
mitigation actions can be tested by changing the values of the related parameters, so that the
effects on a part of or on the global risk network can be observed.
For a particular risk, classical mitigation action is conducted by giving the risk a lower
spontaneous probability without considering its interactions with other risks. A complementary
preventive action is cutting off the input links or reducing their transition probability. This
strategy is compatible with the accumulation or transition risks. Instead of acting on a risk, the
action focuses on the sources of this risk. For instance, the choice of suppliers and the
communication plan are potential sources of many risks in the project, so that paying enough
attention to these points at the beginning of the project may help to avoid many subsequent
risks. Blocking the output links of a risk can be regarded as the action for confining its further
propagation in the network. This is suitable for the source and transition risks. Instead of acting
on the risk, the action focuses on its consequences. For instance, even if it is not possible (or
would involve huge overcosts) to avoid a small delay in the delivery of a part in a civil
engineering project, it is possible to negotiate a contract in which the penalties will begin at a
higher threshold. We do not avoid this risk, since uncertainty is inherent in that work, but we
implement an action to avoid its propagation and amplification to the rest of the project.
3.2.3 Risk network monitoring and control
Planned risk response actions are executed during the project, but their performance needs
to be measured, in order to make sure that they have the desired effects on risks, while not
inducing secondary effects. Moreover, the project, its environment and therefore the risks in the
network, are continuously evolving. The status of the risk network should thus be always
monitored throughout the project. Risk network monitoring and control could result in periodic
- 48 -
risk reviews, identification of new risks, and reporting on response action performance and any
unanticipated effects. This phase provides feedback for the previous phases of the decision
support system. The project manager can use this information to modify the risk network
structure and its parameters, to update the risk analysis reporting, and to amend the risk
response plan.
3.3 Case study results and analysis
In this section, we illustrate the application of the risk network model to a project of
staging a musical show in Paris, France. The project and the results of risk network modeling
have been introduced in Section 2.3 in Chapter 2. This section presents an effort to show the
implementation and the results of the risk network model in each phase of project risk
management.
3.3.1 Simulation model of the project risk network
We conduct simulation analysis for this case study using the software ARENA. ARENA is
a powerful and widely used simulation tool in industry. It is suitable for modeling complex
system and simulating discrete events (Kelton et al. 2007). Figure 17 displays the appearance of
the simulation model built in the environment of ARENA software.
T r u e
F a ls e
D e c id e R 2 R 2A s s ig n R 2 S e p a r a t e R 2O r ig in a l
D u p lic a t e
T r u e
F a ls e
D e c id e R 4 R 4A s s ig n R 4 S e p a r a t e R 4O r ig in a l
D u p lic a t e
T r u e
F a ls e
D e c id e R 8 R 8A s s ig n R 8
T r u e
F a ls e
D e c id e R 1 0 R 1 0A s s ig n R 1 0R 1 0
S e p a r a t e
O r ig in a l
D u p lic a t e
T r u e
F a ls e
D e c id e R 1 9 R 1 9A s s ig n R 1 9R 1 9
S e p a r a t e
O r ig in a l
D u p lic a t e
T r u e
F a ls e
D e c id e R 6 R 6A s s ig n R 6
T r u e
F a ls e
D e c id e R 1 3 R 1 3A s s ig n R 1 3R 1 3
S e p a r a t e
O r ig in a l
D u p lic a t e
T r u e
F a ls e
D e c id e R 1 7 R 1 7A s s ig n R 1 7R 1 7
S e p a r a t e
O r ig in a l
D u p lic a t e
T r u e
F a ls e
D e c id e R 9 R 9A s s ig n R 9 S e p a r a t e R 9O r ig in a l
D u p lic a t e
T r u e
F a ls e
D e c id e R 3 R 3A s s ig n R 3 S e p a r a t e R 3O r ig in a l
D u p lic a t e
C r e a t eI n it ia liz a t io n
A s s ig nS e p a r a t e 0
O r ig in a l
D u p lic a t e
P r o bS p o n t a n e o u s
A s s ig n
R o u t e 0
S t a t io n 8
S t a t io n 2
S t a t io n 4
S t a t io n 1 9 S t a t io n 1 0
S t a t io n 1 3 S t a t io n 6
S t a t io n 1 7
S t a t io n 9
S t a t io n 3
R o u t e 2O u t
A s s ig n R 2
O u tA s s ig n R 1 0
R o u t e 1 0
O u tA s s ig n R 9
R o u t e 9
S t a t io n 1
S t a t io n 7
S t a t io n 1 2
S t a t io n 1 5
S t a t io n 5
S t a t io n 1 6
S t a t io n 1 4
S t a t io n 1 1
D e c id e R 5T r u e
F a ls e
A s s ig n R 5 R 5
D e c id e R 1T r u e
F a ls e
A s s ig n R 1 R 1
D e c id e R 1 6T r u e
F a ls e
A s s ig n R 1 6 R 1 6
S e p a r a t e R 1O r ig in a l
D u p lic a t e
O u tA s s ig n R 1 R o u t e 5
D e c id e R 1 4T r u e
F a ls e
A s s ig n R 1 4 R 1 4
D e c id e R 1 2T r u e
F a ls e
A s s ig n R 1 2 R 1 2
D e c id e R 1 1T r u e
F a ls e
A s s ig n R 1 1 R 1 1
D e c id e R 7T r u e
F a ls e
A s s ig n R 7 R 7
D e c id e R 1 5T r u e
F a ls e
A s s ig n R 1 5 R 1 5
R 1 4S e p a r a t e
O r ig in a l
D u p lic a t e
O u tA s s ig n R 1 4
R o u t e 1 4
S e p a r a t e 1 5O r ig in a l
D u p lic a t e
S t a t io n 2 0
S t a t io n 1 8
D e c id e R 2 0T r u e
F a ls e
D e c id e R 1 8T r u e
F a ls e
A s s ig n R 2 0
A s s ig n R 1 8
R 2 0
R 1 8
R 2 0S e p a r a t e
O r ig in a l
D u p lic a t e
O u tA s s ig n R 2 0
R o u t e 2 0
R o u t e 7S e p a r a t e R 7O r ig in a l
D u p lic a t e
O u tA s s ig n R 7
D is p o s e 1
0
0 0
0
0
0
0 0
0
0
0
0 0
0
0 0
0
0
0
0 0
0
0
0
0 0
0
0 0
0
0
0
0 0
0
0
0
0 0
0
0
0
0 0
0
0
0
0
0
0
0 0
0
0 0
0
0 0
0
0
0
0 0
0
0 0
0
0 0
0
0 0
0
0 0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
Figure 17. Simulation model of the project risk network using ARENA software
In the simulation, one important question is: “how many iterations are needed to reach a
chosen level of precision of the results?” Reference (Banks et al. 2009) gives some formulas
that can be used to estimate a minimal number of iterations. While for our study, it is difficult to
estimate a satisfactory number of iterations because it depends on the size and the complexity
of the risk network (particularly the influence of loops). However, we can still accomplish
sufficient runs by increasing the number of iterations until the output, namely the simulated risk
frequency, become stable enough.
- 49 -
In the case study, we increase the number of simulation iterations gradually from 1 000, 2
000, … , to 10 000. The criterion for evaluating the stability of the output is defined as the
following equation:
2
1
[ ]n
i
RF i Threshold=
D <å (7)
where [ ]RF iD indicates the deviation of the simulated frequency of Risk i with the previous
simulation. The threshold is set to be 10-6
in the test, which ensures that the output deviation
with regard to each risk does not exceed 10-3
. The criterion is always achieved after 6 000
iterations. For statistical and computational convenience, 10 000 iterations are conducted in
each scenario of the risk network model. The simulation time is not a limiting factor, since it
costs less than 5 minutes for 10 000 iterations using the software ARENA on a normal PC.
3.3.2 Risk network analysis
The propagation behavior in the risk network is analyzed as described in Section 3.2.1. In
Table 4, we consolidate the re-evaluation results of risks, and compare them with the results of
classical method. The importance of each risk according to its characteristic value is marked in
different gray scales.
50
Table 4. The comparison of re-evaluated simulation results with those of classical method
Evaluation Results by Classical Method Re-Evaluation Results by Simulation
Risk ID Risk Name Qualitative Probability (Evaluated)
Spontaneous Probability
(Eq (1))
Qualitative Impact
(Evaluated)
Qualitative Criticality (QP*QI)
Evaluated Criticality (SP*QI)
Simulated Frequency (Statistic)
Consequences of Risk (Eq (4))
Simulated Local
Criticality (Eq (5))
Simulated Global
Criticality (Eq (6))
R01 Low budget 8 0.500 7 56 3.50 0.807 32.07 5.65 25.88
R02 Infractions against law 7 0.360 5 35 1.80 0.696 17.46 3.48 12.15
R03 Low communication and
advertising for the show 8 0.500 9 72 4.50 0.771 12.36 6.94 9.53
R04 Unsuitable cast 5 0.126 9 45 1.13 0.495 15.53 4.45 7.69
R05 Unsuitable ticket price-setting 7 0.360 6 42 2.16 0.364 31.19 2.18 11.36
R06 Unsuitable rehearsal management 3 0.011 8 24 0.09 0.266 13.89 2.13 3.69
R07 Cancellation or delay of the first
performance 5 0.126 8 40 1.01 0.425 15.40 3.40 6.55
R08 Poor reputation 3 0.011 7 21 0.08 0.388 8.73 2.72 3.39
R09 Lack of production teams
organization 4 0.050 6 24 0.30 0.049 17.62 0.29 0.85
R10 Low team communication 3 0.011 6 18 0.07 0.529 19.11 3.18 10.11
R11 Bad scenic, lightning and sound
design 2 0.001 7 14 0.01 0.393 12.07 2.75 4.75
R12 Bad costume design 3 0.011 8 24 0.09 0.400 13.50 3.20 5.40
R13 Low complicity between cast
members 3 0.011 7 21 0.08 0.383 13.94 2.68 5.34
R14 Too ambitious artistic demands
compared to project means 7 0.360 2 14 0.72 0.445 7.88 0.89 3.51
R15 Few spectators / Lukewarm
reception of the show 2 0.001 9 18 0.01 0.196 15.88 1.76 3.11
R16 Technical problems during a
performance 4 0.050 5 20 0.25 0.191 7.07 0.96 1.35
R17 Low cast motivation 2 0.001 4 8 0.00 0.469 8.63 1.88 4.05
R18 Unsuitable for family audiences 2 0.001 5 10 0.01 0.002 7.84 0.01 0.01
R19 Low creative team leadership 3 0.011 10 30 0.11 0.014 17.43 0.14 0.24
R20 Low creative team reactivity 2 0.001 2 4 0.00 0.001 7.91 0.00 0.01
- 51 -
Based on the results in Table 4, risks are prioritized by different indicators, shown in Table
5. It gives a different insight on risk priorities due to the changes in risk evaluations and risk
rankings.
Table 5. Risk prioritization results by different indicators
By Spontaneous Probability
By Simulated Frequency
By Evaluated Criticality
By Simulated Global Criticality
Ranking
Risk ID Value Risk ID Value Risk ID Value Risk ID Value
1 R01 0.500 R01 0.807 R03 4.50 R01 25.88
2 R03 0.500 R03 0.771 R01 3.50 R02 12.15
3 R02 0.360 R02 0.696 R05 2.16 R05 11.36
4 R05 0.360 R10 0.529 R02 1.80 R10 10.11
5 R14 0.360 R04 0.495 R04 1.13 R03 9.53
6 R04 0.126 R17 0.469 R07 1.01 R04 7.69
7 R07 0.126 R14 0.445 R14 0.72 R07 6.55
8 R09 0.050 R07 0.425 R09 0.30 R12 5.40
9 R16 0.050 R12 0.400 R16 0.25 R13 5.34
10 R06 0.011 R11 0.393 R19 0.11 R11 4.75
11 R08 0.011 R08 0.388 R06 0.09 R17 4.05
12 R10 0.011 R13 0.383 R12 0.09 R06 3.69
13 R12 0.011 R05 0.364 R08 0.08 R14 3.51
14 R13 0.011 R06 0.266 R13 0.08 R08 3.39
15 R19 0.011 R15 0.196 R10 0.07 R15 3.11
16 R11 0.001 R16 0.191 R15 0.01 R16 1.35
17 R15 0.001 R09 0.049 R11 0.01 R09 0.85
18 R17 0.001 R19 0.014 R18 0.01 R19 0.24
19 R18 0.001 R18 0.002 R17 0.00 R18 0.01
20 R20 0.001 R20 0.001 R20 0.00 R20 0.01
Eckert and co-authors defined (in the context of change propagation in design projects) the
four following categories of risks: constants, absorbers, carriers and multipliers (Eckert et al.
2004). Some risks appear to be high accumulation risks, or “absorbers”, notably the risks R10
(Low team communication) and R17 (Low cast motivation). This can be seen in Figure 16 (in
Section 2.3.2) of the RNM with an important number of inputs (in rows) for these risks. The
changes on the risk occurrence assessment are visible in Table 4 and Table 5, both in the
absolute value and in terms of ranking. The risks of this kind are unlikely to occur
spontaneously, but some other identified risks may lead to them. Some risks have been
moderately anticipated by the classical method, but they are still to some extent underestimated,
such as R4 (Unsuitable cast) and R7 (Cancellation or delay of the first performance). Overall, a
number of risks have increased occurrence frequency in varying degrees, which reflect their
intensity of interactions in the network.
On the contrary, some risks engender many paths in the risk network. For example, R01
(Low budget), R02 (Infractions against law) and R10 (Low team communication) are called
“multipliers” and they may be the original cause of numerous undesired effects. Their direct
- 52 -
consequences on other risks can be seen in Figure 16 (in columns), but their global
consequences in the network are only visible in the simulation results in Table 4 and Table 5,
with the gap between classically evaluated impacts and simulated consequences of the risks.
Among these risks, R02 and R10 are some of the “leverage points” which are initially
underestimated with low impact, nevertheless they should be mitigated because they have a
large potential to trigger other risks. R05 (Unsuitable ticket price-setting) is another example of
the “leverage points”, which does not have numerous direct outputs but has a high impact on
some important risks like R01 (Low budget), with RNM(1,5)=0.770.
The risk prioritization results have changed after the simulation. Several risks have
increased in the ranking in terms of frequency or criticality, while several other risks have
decreased. For example, in the classical method, R03 (Low communication and advertising for
the show) was considered to be the most critical risk, but the one with the highest simulated
global criticality is R01 (Low budget). The value gap between risks has also changed. For
example, R02 (Infractions against law) and R04 (Unsuitable cast) are evaluated with similar
criticality. After re-evaluated by the simulation, R02 is still ranked above R04, and the relative
gap between them has widened. This is the opposite situation for R05 (Unsuitable ticket price-
setting) and R10 (Low team communication): R10 is still behind R05, but closer.
Our focus is then what Eckert and co-workers defined as the “avalanches”, i.e., the
unpredictable propagation of initial events (Eckert et al. 2004). They and other co-authors also
discussed some patterns defining local propagation motifs and defining relationships between
two or three elements (Giffin et al. 2009). We are focusing on more global patterns, which are
potentially the combinations of the local ones, like long propagation chains, heterogeneous
propagation chains and loops. In these three cases, the anticipation and then the decision-
making may be very hard, because of the difficulty to connect elements with different natures
of risks, different actors, and different occurrence times.
Regarding the uncertainties of the estimated input values for the simulation, the
spontaneous probability of each risk is assessed by the experts with three-level values:
optimistic, most likely, and pessimistic, shown in Table 6.
- 53 -
Table 6. Evaluated three-level values of risk spontaneous probability
Spontaneous Probability Risk ID
Optimistic Most Likely Pessimistic
R01 0.450 0.500 0.950
R02 0.100 0.360 0.600
R03 0.350 0.500 0.650
R04 0.010 0.126 0.200
R05 0.250 0.360 0.700
R06 0.005 0.011 0.200
R07 0.010 0.126 0.150
R08 0.010 0.011 0.100
R09 0.010 0.050 0.200
R10 0.010 0.011 0.050
R11 0.001 0.001 0.020
R12 0.005 0.011 0.020
R13 0.005 0.011 0.100
R14 0.100 0.360 0.900
R15 0.000 0.001 0.100
R16 0.045 0.050 0.070
R17 0.000 0.001 0.050
R18 0.000 0.001 0.002
R19 0.005 0.011 0.012
R20 0.000 0.001 0.002
Sensitivity analysis is performed on the three-level values of spontaneous probability.
Each risk has a dissimilar range of simulated global criticality, as shown in Figure 18.
We can find, for example, R02 (Infractions against law) and R05 (Unsuitable ticket price-
setting) have similar most likely values of criticality, but R05 has a larger potential range and
thus it could be more unstable in the project. With respect to the risk prioritization, in all
situations, R01 (Low budget) has higher simulated criticality than R02. Prioritized by the most
likely value, R02 is superior to R03 (Low communication and advertising for the show);
nevertheless, under certain circumstances, R03 will lead to higher impact and be more critical
than R02.
- 54 -
Figure 18. Sensitivity analysis results of project risks
3.3.3 Mitigation actions planning and test
The simulation model allows the project manager to test the actions, which are proposed
based on the risk network analysis, before the implementation. Thus, the project manager can
get the anticipation of their impacts on the network. The presented examples of actions are to
achieve two different goals: the local mitigation of particular risks, and the global risk exposure
mitigation of the risk network. This is a prototype which does not take into account all the
desired information about the action, e.g., its cost and the difficulty or feasibility of its
implementation.
3.3.3.1 Local mitigation
In the simulation results of the case study shown in Table 5, we find that some risks had a
significant increase in terms of frequency and ranking, such as R10 (Low team communication)
and R17 (Low cast motivation). For mitigating their occurrence, there are different possible
strategies, which are displayed in Table 7.
In the first place, if we only apply classical actions by reducing their spontaneous
probability to 0% (we suppose that the spontaneous probability can be reduced to 0% for the
test in the prototype simulation model), R10 and R17 still have high simulated frequencies at
the value of 0.516 and 0.468 respectively. In fact, the increase of simulated frequency is due to
- 55 -
their input links from other risks. This explains why we design and test the non-classical
actions on the risk interactions.
By cutting several of their input links (links from R03, R04 and R07 to R10, and links
from R03, R10 and R13 to R17), the frequency of these “absorber” risks has decreased a lot, as
shown in Table 7. For instance, acting on the transition between R13 (Low complicity between
cast members) and R17 (Low cast motivation) may involve finding other motivation drivers
which make the cast less sensitive to team complicity. This new action on the link is different
from reducing the occurrence of R13, for example, by proposing team-building activities.
Table 7. Effects of different mitigation actions on particular risks
Simulated Frequency after Taking Action
Risk ID Simulated Risk
Frequency Classical Mitigation
Actions on Risks
New Mitigation
Actions on Risk Interactions
R10 0.529 0.516 0.194
R17 0.469 0.468 0.205
3.3.3.2 Global mitigation
With regard to the global risk network, R03 (Low communication and advertising for the
show) has the highest evaluated criticality using the classical method. In the simulation analysis,
R01 (Low budget) becomes the top risk in terms of global criticality. Some mitigation actions
are devised and tested in the risk network model. Figure 19 compares their effects on the global
risk network, i.e., the residual simulated frequency of all the risks after the action is conducted.
Action 1 mitigates R03 according to the classical analysis; action 2 mitigates R01 based on the
new prioritization by the simulation model; in the third action, a new action is executed by
cutting the link from R05 (Unsuitable ticket price-setting) to R01 (Low budget), together with
the classical action 2 on R01. Concretely, this could be done by increasing the part of the
budget which comes from sponsorship and external investors, independently of the sales
income. The financial risk is then shared with different stakeholders. Even if the incomes from
ticket presales are lower, this approach still ensures the normal operation of the project, while
not to get the project stalled or to induce other risks for lack of funds. In this prototype model
for mitigation actions test, we make the assumption that the risk interaction can be completely
cut off, i.e., the transition probability can be reduced to the value at 0%.
The results in Figure 19 demonstrate the effectiveness of applying the risk network model
to support mitigation actions planning.
- 56 -
Figure 19. Comparison of effects on the global risk network by applying different
mitigation actions
3.4 Conclusion
This chapter has presented an interactions-based risk network model using advanced
simulation. The aim is to answer the research questions Q1.2 and Q1.3 concerning risk analysis,
and also Q2.1 and Q2.2 for risk mitigation based on a preliminary case study. The model
addresses the limitations of current methods regarding modeling complexity in project risk
management. The performance of the model and the satisfaction of the users are validated by
the project manager and the associated experts with whom we cooperated for the application to
a real musical show project. The decision support system enables the project manager to save
time for designing risk response plan, and to reduce the cost of dealing with contingencies.
Proactive risk management can be achieved by monitoring the status of the risk network and
adjusting the risk mitigation plan as the project progresses.
Through modeling the propagation behavior in the project risk network, the model enables
the project manager to gain innovative insights into the risks, into the relationships between
them, and into the global risk network behavior. The refined risk analysis and prioritization
results support the project manager in making decisions, for instance, planning more effective
mitigation actions. The model is also useful for testing and evaluating the proposed action plans.
In addition to the examples of actions tested in Section 3.3.3, a complete list of mitigation
- 57 -
actions can be proposed to the project manager based on the risk network model. The project
manager is able to choose a portfolio of actions to manage the project risks.
The selected case study analyzes a number of typical risks in a project of staging a musical
show. Moreover, the approach manipulates values of risks and risk interactions, independently
of their nature, their number and the type of project. In the risk management of any kind of
project, generally risks are all assessed in terms of probability and impact, which are here
included in the simulation model. This is why the approach can be generalized and applied to a
much wider set of projects. Since the model uses matrix-based and simulation-based methods,
the approach is possible to be applied in some very complex situations.
The effectiveness of the model also depends on the validity of the input estimations. At the
end of Section 3.3.2, we performed a preliminary sensitivity analysis on the three-level
estimations of risk spontaneous probability. The sensitivity analysis results demonstrate the
influence of input uncertainties of the risk network assessment on the subsequent risk analysis
results. In addition, there exist potential changes in the project and uncertainties in the external
environment as the project advances. Therefore, considering the reliability of the analysis
results and the uncertainties in the later phases of the project, the risk network should be
monitored after the implementation of actions, and the response plans will be modified and
improved. With regard to the example used in this chapter, the study took place at the end of the
project in order to verify the usefulness of the developed prototype of the risk network model.
The application of the monitoring phase will be included in future real-time case studies.
Furthermore, in practice, more parameters like cost of actions should be included so that
the mitigation plan can be optimized under resource constraints. The work concerning this issue
will be discussed in Chapter 6.
- 58 -
- 59 -
Chapter 4 - Topological Network Theory-Based
Project Risk Analysis
Abstract
Complex engineering projects are exposed to interdependent risks of various natures. In
this chapter, we present an analysis, based on network theory, for identifying key factors in the
structure of interrelated risks potentially affecting a project. This original approach serves as a
powerful complement to classical project risk analysis. The outcomes of the analysis provide a
support for decision-making regarding project risk management.
The risk network structure is built using the methods described in Chapter 2. Some
network theory-based indicators are tailored to project risk network. Their implications on
project risk management are discussed. Eigenstructure analysis is performed based on the Risk
Structure Matrix (RSM) with the goal of measuring the importance of risks in the network. This
measurement reflects the influence of a risk taking into account both its direct and indirect
connections with the other nodes in the network.
An example of application to a real complex engineering project, a tramway
implementation project, is presented. The results of topological analysis provide more and new
insights on risks and risk interactions in the network, which is beyond the capability of classical
project risk analysis methods. A combination of several feasible actions is tested to show the
usefulness of the proposed analysis.
Chapter Keywords
Network theory, topological analysis, organization interface, betweenness centrality,
eigenvector centrality, decision support
- 60 -
4.1 Introduction
Network theory is in the area of mathematics and computer science, and has been built
upon graph theory (Belevitch 1968; West 2001; Bondy and Murty 1976; Wilson and Wilson
1996). Because of its inherent simplicity, graph theory has a very wide range of applications in
engineering, in physical, social and biological sciences, in linguistics, and in numerous other
areas (Deo 2004). A graph can be used to represent almost any network structure involving
discrete objects and the relationships among them.
As introduced in (Kröger and Zio 2011), topological analysis based on classical graph
theory can unveil relevant properties of the structure of a network system (Albert et al. 2000;
Strogatz 2001). It can be used to (1) highlight the role played by its components, nodes and
connecting arcs (Crucitti et al. 2006; Zio and Sansavini 2008); (2) make preliminary
vulnerability assessments based on the simulation of faults (mainly represented by the removal
of nodes and arcs) and the subsequent re-evaluation of the network topological properties
(Rosato et al. 2007; Zio et al. 2008). In the last decades, a number of studies have focused on
the modeling of complex systems such as critical infrastructures from the standpoint of network
theory. They aim at understanding how the network underlying the system influences its
behavior, and eventually its characteristics of stability and robustness to faults and attacks (Zio
2007). Topological network analysis has been exploited to serve as a screening tool to identify
key components in different types of infrastructure networks, like for instance power
transmission systems (Eusgeld et al. 2009) and railway networks (Sen et al. 2003).
In our study, topological analysis derived from network theory is used to analyze the
structural properties of the project risk network. The aim of this chapter is to identify important
risks and risk interactions with respect to their roles in the network. This provides information
which can complement the classical analysis based on the assessment of risk probability and
impact. The originality is to apply network theory-based topological analysis and eigenstructure
analysis in the context of project risk management, and particularly to tailor some network
theory indicators. The application to a real complex engineering project enables us to validate
the usefulness and practicality of the approach proposed.
4.2 Definition of topological indicators for project risk
analysis
For the topological analysis of a project risk network, we represent the risk network by a
graph G(N, K), in which the identified risks are mapped into N nodes (or vertices) connected by
K unweighted edges (or arcs). The risk network is a directed network: each edge from Ri to Rj
represents the fact that there is a directed potential cause-effect link between them. In the jargon
of graph theory, the RSM is the adjacency matrix of the risk network (West 2001).
Such representation enables us to study the structural properties of the risk network, by
means of some topological indicators tailored to the problem at hand. These indicators can help
- 61 -
identifying key factors (important risks or risk interactions) and improve the project manager’s
understanding of the vulnerabilities in the network. In the next paragraphs, we will give the
definition of some indicators and discuss their implications on project risk management.
4.2.1 Connectivity indicators
The numbers of nodes and risk natures/domains describe the size and diversity of the risk
network. The density of the graph can be measured by Equation (8). Usually some pairs of
nodes are disconnected and thus the risk network is not a fully connected graph. There may also
be unconnected nodes representing isolated risks, i.e., risks having no correlation or negligible
correlation with other risks in the network.
,
( ) / ( 1) / ( 1)iji j G
Den G K N N RSM N NÎ
= - = -å (8)
The degree of nodes provides an indication of the local connectivity characteristic of a risk.
The number of outgoing edges is the activity degree of a risk (Equation (9)) and the incident
edges give the passivity degree (Equation (10)) of it (Kreimeyer 2010). These two metrics
convey the relationship of a risk with its immediate neighbor risks:
Ai ji
j G
Deg RSMÎ
=å (9)
Pi ij
j G
Deg RSMÎ
=å (10)
There might be several different paths linking one risk (node) to another, via one or
multiple steps (edges). Let dij indicate the length of the shortest path from Rj to Ri. The upper
value of dij is called the diameter of the network (Albert and Barabási 2002). It can be thought
of as the maximum number of steps necessary to spread the impact of a randomly chosen risk
to another randomly chosen risk in the network.
In order to get further insights on the global connectivity property of the risks, we study
the reachability degree of nodes. We introduce the concept of Risk Reachability Matrix (RRM),
with RRMij = 1 if there exists at least one path from Rj to Ri.
Both the shortest path between each pair of risks and the RRM can be obtained using the
Floyd’s sequential shortest path iterative algorithm (Floyd 1962; Pallottino 1984). The
reachability density defined in Equation (11) is a measure of the complexity of the risk network
based on risk reachability:
,
( ) / ( 1)iji j G
Rea G RRM N NÎ
= -å (11)
The number of reachable nodes (Equation (12)) indicates the number of other risks that a
given risk can impact directly and indirectly. The number of possible sources (Equation (13))
accounts for the fact that the occurrence of a designated risk can possibly originate from many
other risks in the network.
- 62 -
Ri ji
j G
N RRMÎ
=å (12)
Si ij
j G
N RRMÎ
=å (13)
These indicators of reachability degree help us to understand the global consequences and
sources of a risk, and enable us to classify the risks into different categories.
4.2.2 Interface indicators
In project management, risks are usually categorized into different domains such as
technical, financial and managerial classes. Further, from the point of view of organization,
different risk owners are usually assigned in charge of one or several risks. The number of
interfaces between domains/owners is defined as the number of edges between each pair of
them. In the local sense, the indicators uv
LDI and
uv
LOI defined in Equations (14) and (15) below
denote the number of local direct interfaces from Dv to Du and from Ov to Ou respectively,
where Du and Ov stand for domain u and risk owner v:
,uv
i u j v
LD ij
R D R D
I RSMÎ Î
= å (14)
,uv
i u j v
LO ij
R O R O
I RSMÎ Î
= å (15)
On the other hand, the indicators uv
GDI and
uv
GOI defined in Equations (16) and (17) indicate
the number of global reachable interfaces from Dv to Du and from Ov to Ou respectively:
,uv
i u j v
GD ij
R D R D
I RRMÎ Î
= å (16)
,uv
i u j v
GO ij
R O R O
I RRMÎ Î
= å (17)
The interface indicators help project managers identify the interconnections between
different domains and enhance the intercommunication between correlated counterparts. It
notably enables the grouping of risk owners in order to improve coordinated decision-making.
4.2.3 Betweenness centrality
For the purpose of anticipating the potential risk propagation and related needs for
protection, another indicator is introduced. In general network theory, the betweenness
centrality (Freeman 1977; Guimera and Amaral 2004) is based on the idea that a node or an
edge in a network is central if it lies between many other nodes. In a risk network, if a risk node
or a risk interaction edge lies in at least one of the paths connecting a pair of other nodes, we
count that node or edge as lying between them. The betweenness centrality of Rk and the
- 63 -
betweenness centrality of the edge from Rp to Rq can then be calculated by the following
equations:
, ,
ANDk ki jki j G i j k
B RRM RRMÎ ¹ ¹
= å (18)
, ,
ANDp q pi jqi j G i j p q
B RRM RRM®Î ¹ ¹ ¹
= å (19)
In practice, project risk networks are often quite sparse, with K<<N (N-1)/2, hence we do
not normalize the betweenness centralities by dividing by their possible upper values, i.e., (N
1)(N N N ralities of
nodes or edges denote the number of pairs of risks they lie between.
Knowledge of these centralities assists in identifying hubs in the network which play the
role of key passages for risk propagation: the project manager should consider how to avoid
propagation through these passages by controlling the risks and/or blocking their interactions.
4.3 Eigenstructure analysis of risk network
In mathematics, eigenvalues and eigenvectors are related concepts in the field of linear
algebra, which describe characteristics of a matrix. Analyzing these eigenstructure properties
gives important information about the adjacency matrix and its related network. The
mathematical expression of eigenstructure decomposition is as follows: if M is a square matrix,
a non-zero vector v is an eigenvector of M if and only if
Mv vl= (20)
The scalar is said to be the eigenvalue of M corresponding to v.
In our study, we perform eigenstructure analysis on the RSM with the intention of
exploring importance measurement of project risks within the network context.
Let xi denote the score of the i-th node, i.e., the measure of the importance of Risk i. We
use the square matrix A to denote the adjacency matrix of the risk network. Hence,
( ) ( , )ijA a RSM i j= = and
1 if there is an edge joining node to
0 otherwise
ij
ij
a j i
a
=ìïí
=ïî (21)
For the the i-th node, let its score be proportional to the sum of the scores of all the nodes
which are directly connected to it. Here we take into account both the input and output links,
i.e., both the immediate predecessor and successor risks of Risk i in the network. Thus, we get
the following equation:
( ) ( ) 1
1 1 1( )
N
i j j ij ji jj P i j S i j
x x x a a xl l lÎ Î =
= + = +å å å (22)
- 64 -
where P(i) is the set of nodes that are direct predecessors of the i-th node and S(i) is the set of
nodes that are direct successors of the i-th node. In this way, the importance of Ri is equal to the
average importance of all its neighbor risks. Then we can reformulate the Equation (22) as:
1( )Tx A A x
l= + (23)
where AT is the transpose matrix of A, and then as the eigenvalue equation:
( )TA A x xl+ = (24)
In general, there will be many differe
exists. However, in linear algebra, the Perron–Frobenius theorem, proved by Oskar Perron
(Perron 1907) and Georg Frobenius (Frobenius et al. 1912), asserts that a real square matrix
with positive entries has a unique largest real eigenvalue and that the corresponding eigenvector
has strictly positive components, and also asserts a similar statement for certain classes of
nonnegative matrices. Usually, the Perron-Frobenius theorem applies to our case of risk
network and the matrix A+AT.
Bonacich in (Bonacich 1972) suggested that the eigenvector of the largest eigenvalue of an
adjacency matrix could make a good network centrality measure. Unlike degree indicators,
which weight every contact equally, the eigenvector weights contacts according to their
centralities (Bonacich 2007).
We define the i-th element xi of the eigenvector *
as the eigenvector centrality of Ri in the risk network. Eigenvector centrality is a measure of the
importance of a node in the risk network. It assigns relative centrality scores to all nodes in the
network based on the principles: (1) connections to more nodes contribute more to the score of
the node; (2) connections to high-scoring, namely important nodes, contribute more to the score
of the node.
In this sense, eigenvector centrality calculates not only direct connections but also indirect
long-term propagations. Thus the complete risk network is taken into account. Mathematically,
eigenvector centrality is closely related to the influence measures, such as those proposed in
(Hadi 1992; Katz 1953; Taylor 1969; Friedkin 1991). The idea is that even if a node influences
directly only one other node, which subsequently influences many other nodes (who themselves
influence still more others), then the first node in that chain is highly influential (Borgatti 2005).
For calculating the risk eigenvector centrality, besides the output links of a risk which
contribute to its impact measure in the network, we also incorporate its input links for
measuring its importance in terms of probability. That is why the matrix A+AT is used for the
proposed eigenstructure analysis.
- 65 -
4.4 Case study
In this study, we implement the proposed approach to a real large project, aimed at
building the infrastructure and associated systems of a tramway. This project takes place in a
city in Europe with a population of 750 000. Both classical project risk analysis and the
proposed network theory-based analysis on the topological structure are carried out.
The project includes the construction and implementation of tramway, equipments, and
civil work, with 10 years duration and hundreds of millions € budget. The leading company is a
designer and manufacturer of trains, which recently extended its scope by proposing “turn key”
projects, including not only the trains, but also the complete infrastructure around the trains.
The project thus comprises:
· The construction of a depot to stock trains and to execute their control and
maintenance;
· The installation of tracks throughout the city, over land with many steep slopes;
· The delivery of the corresponding trains, including redesign activities if the current
version does not fit with the city’s specific requirements;
· The establishment of a traffic signaling operating system, which gives priority to
the tramway so as to guarantee travel time performance levels.
4.4.1 Building the structure of project risk network
The first step is to build the structure of project risk network. An original project risk list
has been provided by the project manager and its expert team, which contains 42 project risks.
The risk list has been updated when performing the risk interaction identification. Some new
risks have been added into the list, for two reasons: some were a consequence or cause of other
risks already present in the initial list; others were seen as intermediary risks which were useful
to explain the link between two or more risks of the initial list. Thus, the resulting project risk
list contains 56 identified risks at the main level, with their name, domain and risk owner
information, as shown in Table 8.
- 66 -
Table 8. Project risk list with classical risk characteristics of the tramway project
- 67 -
Identification of the risk interactions defines the structure of the project risk network.
Using the methods described in Section 2.1 in Chapter 2, we get the risk network structure
(shown in Figure 21) and the corresponding risk structure matrix (RSM, shown in Figure 20) of
this case study. Each marked cell in the matrix indicates that there is a related link in the
network structure.
Figure 20. RSM of the tramway project
68
Figure 21. Project risk network structure of the tramway project
- 69 -
4.4.2 Classical project risk analysis
As we can see in the classical project risk list (Table 8), these potential negative risks are
classified according to six domains (22 risks of D1-Technical, 24 risks of D2-Contractual, 6
risks of D3-Financial, 1 risk of D4-Client/Partner/Subcontractor, 2 risks of D5-Project
management on construction site, 1 risk of D6-Country). Risk ownership in terms of
responsibility is assigned to 11 actors in the project management team. Basic characteristics of
risks have been assessed by the project manager and associated experts, as shown in Table 8,
including qualitative probability (or likelihood) and impact (or severity) scales, as well as
criticality (aggregation of probability and impact).
In classical project risk analysis, risks are considered most important if of both high
probability and impact. Criticality is an aggregate characteristic used to prioritize risks (often
the product of probability and impact, even if this has some issues (Marle 2008). The results of
this type of analysis are used by the project manager for risk response planning. Resources are
firstly allocated to manage the risks prioritized with high criticality.
In Figure 22, the classical project risk analysis results are displayed in a risk impact vs.
probability diagram, where each risk identified in Table 8 is represented by a dot. The limits
between different criticality classes should be defined a priori, before the risk assessment. For
example, risks can be categorized into several levels of criticality, such as critical, high,
moderate and low risks. In Figure 22, we only highlight the top ten risks (display their IDs)
according to their criticality value. The project is based on a contract including many
contractual terms involving financial penalties in case of failure, whether on time or quality
aspects. Almost every problem is then potentially transformed directly or indirectly into an
additional cost and then a profit loss. It is thus not surprising to see that R2 (Liquidated
damages on intermediate milestone and delay of progress payment threshold), R37 (Rejection
of Extension Of Time), R43 (Return profit decrease) and R55 (Available cash flow decrease)
are among the most critical risks. Other risks with high criticality are generally related to the
final delivery, like R12 (Operating certificate), or some big parts of the project, like R18 (Civil
Work delay) and R40 (Operating Center installation).
- 70 -
Figure 22. Display of classical project risk analysis results
4.4.3 Topological network analysis
Once we have built the project risk network structure, the topological network analysis can
be done by computing and analyzing the indicators defined in Section 4.2.
The project risk network (Figure 21) is comprised of 56 nodes (risks) and 95 edges (risk
interactions), with only 5 unconnected nodes (R8, R11, R15, R23 and R34). The graph density
is equal to 0.0308, showing that the network is relatively sparse. The diameter of the risk
network is equal to 4. This means that the hierarchy structure of the network is relatively flat. In
other words, a risk can reach and impact another risk, for example, from an initial technical
problem to a financial performance risk, through a shortest path of less than 4 steps.
In Figure 23, we display the activity degree and passivity degree of risks in a matrix
diagram. As we can see, a risk can directly impact at most 5 other risks; the passivity degree
varies from 0 to 19, while only several risks have a large number of direct predecessors. For
example, R2 (Liquidated damages on intermediate milestone and delay of progress payment
threshold) has 19 immediate predecessor risks. Most risks have 1 or 2 immediate inputs and
outputs, implying that the local connectivity of this network is not significant.
- 71 -
Figure 23. Diagram of degree of risks
Similarly, the reachability degree of risks, namely the number of reachable nodes and the
number of possible sources are displayed in Figure 24. This gives a global view of the
connectivity property of risks.
The reachability density of the network is equal to 0.0854. This shows that the risk
network is more complex in the global view of reachability, compared with the low graph
density of 0.0308 of the local scale. Some risks with few predecessors while leading to many
others are likely to be source risks, such as R6 (New local laws and regulations), R49 (Error in
the topography survey), R27 (Track installation machine performance), R16 (Archeological
findings), and R19 (Responsibility of client on civil work delay). Some risks with few
successors while stemming from many possible sources are regarded as accumulation risks,
often related to project results like financial performance, e.g., R43 (Return profit decrease) and
R55 (Available cash flow decrease). Risks in the middle area away from axes in Figure 24 act
as transition risks. Some of the transition risks having more inputs and fewer outputs are closer
to the accumulation risks, such as R2 (Liquidated damages on intermediate milestone and delay
of progress payment threshold), R12 (Operating certificate delay) and R52 (Reengineering /
Redesign); some of them are closely related to the source risks, for example, R5
(Traction/braking function: behavior in degraded mode on slope) and R18 (Civil work delay &
continuity); other risks like R10 (Travel time performance), R13 (Reliability & availability
targets) and R39 (Risk on certification of equipment) have approximately equal number of
possible sources and reachable nodes. The roles of these risks in the network are marked with
different shapes in the risk network structure shown in Figure 27. This classification of risks
- 72 -
depending of their respective number of inputs and outputs assist the project manager to decide
how to treat them or not, independently of their individual assessment.
Figure 24. Diagram of reachability degree of risks
Figure 25 and Figure 26 show the number of interfaces between risk domains and owners
respectively, from both local and global points of view. Since most risks are belonging to D1-
Technical, D2-Contractual and D3-Financial, a large amount of interactions are related to them.
In Figure 25, we can see that a large proportion of direct connections are inside a domain.
However, many interfaces between different domains have emerged in the global vision. For
instance, D1-Technical risks will indirectly cause more contractual and financial risks in D2
and D3; risks from D4-Client/Partner/Subcontractor, D5-Project management on construction
site and D6-Country have no direct influence on financial risks but will reach them after
propagation of several steps.
Figure 25. Interfaces between risk domains with local and global viewpoints
- 73 -
Similarly, many indirect interfaces between risk owners have appeared. On the left part of
Figure 26, we find that the risk owner O2 receives direct impacts from each of the other owners.
In the global perspective, shown on the right part of Figure 26, he/she should be more aware of
the noticeably increased potential influences from several counterparts like O1 and O4.
Moreover, some risk owners cannot identify the direct impact from other actors, but they
should foresee and be prepared for the propagated consequences. For instance, the number of
interfaces indicated in the cell O2 to O3 has increased from 0 to 6.
Figure 26. Interfaces between risk owners with local and global viewpoints
Table 9 displays the top five nodes and top five edges with the highest betweenness
centrality. They are also highlighted in Figure 27, respectively with grey-filled nodes and bold
edges. Risks with the highest betweenness centrality such as R2 (Liquidated damages on
intermediate milestone and delay of progress payment threshold) and R52 (Reengineering /
Redesign) act as hubs of connecting many pairs of risks. We can see that the most important
edges are related to these top risks. R10 and R13 are the sources of many events and should be
treated with caution, mainly with preventive actions or with confinement actions (edges from
R10 or from R13, especially the R10->R13 edge). Confinement actions are quite new in the
project management field, where the actions are focused on nodes only.
Table 9. The top risks and interactions according to the betweenness centrality
Rank Risk ID Betweenness
centrality Edge ID
Betweenness
centrality
1 R2 82 R10->R13 42
2 R52 60 R2->R55 41
3 R10 56 R13->R39 40
4 R12 48 R52->2 40
5 R13 48 R12->R2 32
74
Figure 27. Structure of the project risk network (with highlighted important risks and interactions)
- 75 -
4.4.4 Eigenstructure analysis
We conduct the eigenstructure analysis described in Section 4.3 on this case study. The
eigenvalues and eigenvectors of the matrix A+AT (A is the RSM of the project) are computed
using Matlab software (version R2010b).
The unique largest real eigenvalue* is equal to 6.4874. Here we only list the risks with
top-ten eigenvector centralities, shown in Table 10.
Table 10. The top-ten risks according to eigenvector centrality
Rank Risk ID Eigenvector centrality
1 R2 0.5124
2 R43 0.2990
3 R55 0.2901
4 R12 0.2703
5 R10 0.2155
6 R53 0.2055
7 R18 0.1997
8 R52 0.1981
9 R51 0.1660
10 R7 0.1646
As we can see, most important risks in the sense of topological analysis (e.g., risks
highlighted in Table 9 and Figure 27) are included in this list. Some risks like the accumulation
risks R43 (Return profit decrease) and R55 (Available cash flow decrease) have high
eigenvector centralities because they have many predecessor risks. Thus, the consequences of
many other risks are revealed through them, either directly or after propagation of several steps.
Some risks in Table 10 were not identified as important ones by topological analysis, such as
R53 (Slabs pouring delay), R18 (Civil Work delay & continuity), R51 (Track installation delay)
and R7 (Traffic signaling, priority at intersections). They have high eigenvector centrality
values because they have direct contacts with some key nodes (e.g., R2, R12, R10, R52, etc.)
and/or they can reach these important risks within short paths, which enhance the measure of
their influence in the network.
4.4.5 Discussion of the results
The results obtained in the presented application prove the utility of the topological
network theory-based approach and the eigenstructure analysis for risk analysis in project
management. The proposed indicators provide the project manager with useful information for
understanding identified risks and their relationships of both local and global scales.
Several critical risks identified by classical project risk analysis are confirmed by the
topological analysis and eigenstructure analysis to play an important role in the risk network,
- 76 -
for instance, the financial risks like R43 and R55. In addition, more is learned about their
relationship with other risks in the network. Taking into account the complexity-related
phenomena, some new key risks are identified by the topological analysis and eigenstructure
analysis, which are supplementary results to classical analysis. Risks can be classified into
different categories according to their positions in the network. This information helps the
project manager plan mitigation actions suitable for each particular type of risks. For example,
many source risks like R16, R19, R6, R27, and R49 were not identified as critical in the
classical analysis. Paying attention to these risks at the beginning of the project may help avoid
many problems arising at later stages. Preventive or confinement actions are more likely to be
effective for this kind of risks. Corrective or protection actions are often designed for
accumulation risks like R43 and R55 to reduce losses. Avoidance or mix of strategies can be
applied to transition risks for mitigating the risk propagation.
Moreover, important interactions with high betweenness degree are also identified. Cutting
or easing this kind of key passages would mitigate the potential propagation between many
risks in the network. For example, cutting the edge R10->R13 will act as a decoupling of two
separate parts of the network. It means that if the internal nodes of one part are correctly
managed, no risk of external origin has to be considered. This is all the more important since
internal risks are generally easier to influence and to manage for the owners. Allocating
resources and conducting actions on these key risks or interactions will be more efficient to
mitigate the propagation phenomena and then to reduce the overall exposure of risks.
In this example, based on the topological and eigenstructure analysis, we tested a
combination of four actions: 1) avoid R12 (Operating certificate delay); 2) avoid R27 (Track
installation machine performance); 3) avoid R52 (Reengineering / redesign); and 4) cut the link
between R10 (Travel time performance) and R13 (Reliability and availability targets).
Applying these actions translates into removing the nodes (R12, R27, and R52) and the edge
(R10->R13) in the risk network. The first interesting thing is that only R12 is in the top-ten list
of critical risks according to classical project risk analysis. R12 is a transition risk with many
causes and only two, but important direct consequences which are financial risks of R2 and
R55. R27 is low in terms of classical criticality, but is a source of numerous and important risks,
so it may be worthy to use a non-innovative but non-risky track installation machine, in order to
estimate with more reliability the duration of track installation tasks. R52 with high
betweenness and eigenvector centralities is a product-related risk, depending on multiple causes
related to the train performance, the customer requirements and the interface rail-wheel. In
order to prevent this risk, a more robust requirement definition should be made at the beginning
of the project, including the specificities of the project (the city topography and the special
needs of the customer). Of course this has to be done for every project, but in this case we
contend that a particular effort should be put on the reliability of the initial product
requirements, because of their multiple consequences. Finally, we propose to act on the link
between R10 and R13, which is quite specific to a topological analysis, since we do not act on
nodes, but on one edge. We do not avoid the problem caused by R10 and its other
consequences, which are mainly related to customer and contract, but we avoid propagation to
- 77 -
another part of the network, where technical and product-related risks could have been
activated. It is feasible to cut the transition between the two risks, since there are
complementary means to reach reliability and availability targets (train size, train number)
without redesigning the train and delaying the delivery of operating certificate. Further work
will integrate the cost of actions and make the balance with the benefits of risk reduction. To
conclude, all the proposed actions are feasible but three of them come directly from the
topological network analysis and only one of them could be identified through classical
analysis.
By undertaking the proposed actions, the graph density has been reduced from 0.0308 to
0.0265 by 14.0%, and the reachability density of the network has been reduced from 0.0854 to
0.0679 by 20.5%. The new top risks and interactions with the highest betweenness centrality
are given in Table 11. Compared with Table 9, we can see that the ranking has changed and the
values of betweenness centrality have significantly decreased. The updated top-ten risks and
their eigenvector centralities are shown in Table 12. It is not surprising that the removed nodes
R12 and R52 are no longer in the list. The top eigenvector centrality values have not decreased
but to some extent have increased, which reflects that the eigenvector centrality is relative score
of a node in terms of importance in the network. The ranking of R10 have decreased since one
of its important links has been removed. R7 has fallen out of the list due to its close contact
with R10.
The change of the risk network structure after taking the mitigation actions is shown in
Figure 28.
- 78 -
Table 11. The top betweenness centralities after taking actions
Rank Risk ID Betweenness
centrality Edge ID
Betweenness
centrality
1 R2 64 R2->R55 32
2 R55 39 R10->R44 21
3 R10 28 R18->R48 8
4 R44 24 R46->R10 8
5 R18 16 R5->R46 7
Table 12. The top risks according to eigenvector centrality after taking actions
Rank Risk ID Eigenvector centrality
1 R2 0.5326
2 R43 0.3860
3 R55 0.2857
4 R53 0.2551
5 R18 0.2385
6 R44 0.1849
7 R10 0.1592
8 R4 0.1576
9 R51 0.1486
10 R48 0.1480
79
Figure 28. Structure of the project risk network after taking actions
Also, the interface degree between domains/owners gives the project manager knowledge
of how to improve the structure of organization. Reassignment can be conducted so as to
reduce the interfaces between different owners. In other words, closely related risks should be
assigned when possible to the same owner, in order to mitigate the risk of information
asymmetry or non-communication, and to reduce the cost of communication. These
reassignments are identified through different sources. First, the right part of Figure 26 gives
global information on the direct and indirect interfaces between owners. For instance, owners
O2 and O4 are strongly related with indirect links, which means that their relation in terms of
communication and coordination should be well formalized. Second, the potential chains or
pieces of the network with several interrelated risks and some of the highlighted nodes and
edges (Figure 28) that deserve particular attention for topological reasons (Table 11) assist in
identifying more effective local reassignments. For a given couple, triplet or group of risks,
decisions have to be made on the basis of the existing assignments (Table 8). It depends on the
number of actors currently involved and on their skills, in terms of capacity to become the
owner of the designated risk. For example, in order to get fewer people involved in potential
propagation chains (Figure 28), we can reassign the ownership of:
1) risk R18 to actor O2 (instead of O8), since O2 is already the owner of R16 and R19.
2) risk R32 to actor O3 (instead of O5), since O3 is already the owner of R51 and R48. It
permits also to have only one human interface between O2 and O3 for managing the
interactions between several risks.
3) risks R5 and R46 to actor O4 (instead of O1). Indeed, actor O4 is in charge of
managing several risks potentially triggering R10, which is an important hub in the
technical area of train performance and customer satisfaction.
4.5 Conclusion
This chapter presents an original network theory-based analysis of project risk. The
purpose is mainly to discuss “What roles the risks act in the network” (research question Q1.1).
First, the project risk network needs to be built up, as described in Chapter 2. One should be
aware of the particularity of a project risk network, as compared to, for example, other physical
networks of critical infrastructures, like a power transmission network. A project risk network
links elements (nodes of risks), which can possibly be affected by the potential propagation
(edges of risk interactions) of effects of different natures. The specificity of this network is to
involve potential interactions between nodes which are not necessarily related to physical and
material characteristics, like delay risk for instance.
Network theory indicators are specifically tailored to project risk analysis, in an effort to
complement the classical approach with respect to modeling the complexity of interdependent
risks. For example, some connectivity indicators and the betweenness centrality are introduced
in order to identify the key risks and risk interactions in the network. Moreover, eigenstructure
analysis is performed, i.e., by computing the eigenvector centrality, to measure the importance
of risks taking into account the entire pattern of the network. The interface indicators, which
- 81 -
indicate the interconnections between different domains and between different owners in terms
of risk propagation, are helpful for the project manager to make decisions like concerning
organization.
A realistic application to a tramway implementation project is performed with the
involvement of the project manager and the team of experts. The obtained results demonstrate
that the topological risk network analysis adds value to the classical project risk analysis, in
identifying both the important risks and the important risk interactions with respect to their role
in the network behavior. This gives additional information for the next step of decision-making,
since risks may be considered important for criticality and/or topological reasons. In other
words, a risk taken individually may be non-critical, but through interactions could become the
source of other risks and some critical ones. Based on the analysis outcomes, a combination of
feasible risk mitigation actions are performed on the risk network and the results demonstrate
the effectiveness of using network theory for project risk topological analysis. The method is
expected to be applicable to a wide set of engineering projects for decision support, including
designing risk mitigation actions and reassigning risk owners.
A further improvement of the proposed approach in this chapter is to analyze the weighted
risk network. In other words, if we get the numerical assessment of the nodes and the strength
of edges, we are able to quantitatively analyze risk propagation behavior in the network. This
work will be introduced in the next Chapter.
- 82 -
- 83 -
Chapter 5 - Matrix-Based Propagation
Modeling for Risk Analysis
Abstract
The overall ambition of this chapter is to propose a quantitative method for modeling the
risk propagation behavior. This method is based on matrix calculation. It can be used as a
supplement to the classical project risk analysis and the topological risk network analysis
presented in Chapter 4. All these risk analysis results will assist project manager in planning
more effective risk response actions.
A risk propagation model is presented with some assumptions. It can be used to calculate
risk propagation and thus to re-evaluate risk probability and criticality taking into account its
position in the network. Moreover, the eigenstructure analysis is extended to the weighted risk
network which assesses the strength of risk interactions. Updated risk prioritization by various
indicators provides project manager with improved insights on risks under complexity.
First, a simple example of risk network with 7 nodes is given to illustrate how to use the
risk propagation model. Second, the application to the musical staging project (introduced in
Chapter 2) allows us to validate this model through comparing with the simulation results.
Third, both the risk propagation model and the eigenstructure analysis are implemented to the
tramway construction project (introduced in Chapter 4) for risk analysis.
Chapter Keywords
Weighted network, stochastic matrix, risk propagation, eigenvector centrality, risk
prioritization
- 84 -
5.1 Matrix-based risk propagation modeling
In this section we will present a matrix-based risk propagation model for risk re-evaluation.
A simple example with seven risks will be used for illustration.
5.1.1 Basic concepts and assumptions
In the project risk network, the nodes (risks) are assessed in terms of spontaneous
probability and impact (or severity); the edges (risk interactions) are assessed as the probability
of transition from one risk to another. As described in Section 2.2 in Chapter 2, a distinction
between the spontaneous probability of a risk, for example, caused for an external reason or by
undefined risks outside the system, and the probability of this risk triggered by any other
identified risk inside the system has been made during the assessment process. Thus in this
matrix-based propagation model, we assign the original risk probability evaluated by classical
methods without considering interactions to each risk as its spontaneous probability. For the
same reason, the assessed values in the risk numerical matrix (RNM) are used as transition
probability between the related risks in the column and row labels.
Some assumptions are made in order to calculate risk propagation in the network:
1) A risk may occur more than one time during the project (this does accord with the
situation in reality). Risk frequency is thus accumulative if arising from different
causes or if arising several times from the same cause.
2) The structure and values of RNM do not vary during the analysis time. In other
words, there is no added or removed risk, and the transition probability between
risks will not change during the analysis.
Hence, the RNM can be regarded as similar to the stochastic matrix or transition matrix
used to describe the transition of a Markov chain (Bhat and Miller 2002; Meyn et al. 1993;
Buzacott and Shanthikumar 1993; Latouche et al. 1999). This principle has been applied to
industrial engineering, for example, Smith and Eppinger introduced a work transformation
matrix based on the DSM method to model the engineering design iteration process (R. Smith
and Eppinger 1997). However, different from conventional stochastic matrix, in our model the
RNM is a square matrix where all entries are nonnegative real numbers and less than 1, but the
sum of each row or column is not necessary to be 1.
5.1.2 Risk propagation model
Suppose there are N identified risks in the network. We use vector s to represent the
spontaneous probability of risks. Let the N-order square matrix A denote the RNM of transition
probabilities. P(R) is the vector of risk probabilities after propagation analysis.
Vector s also represents the initial vector of risk probabilities. After m steps, the
probability vector of risks propagated from initial state is thus equal tomA s× . If we only
- 85 -
consider m steps of propagation and according to the assumption of accumulative risk
frequency, the re-evaluated risk probability vector can be obtained by the following equation:
1 1 0
( ) ( ) ( )m m m
i i i
i i i
P R s A s I A s A s= = =
= + × = + × = ×å å å (25)
where I is the N-order identity matrix. If not considering the limit of stages in project, then we
have:
0
( ) lim( )m
i
mi
P R A s®¥
=
= ×å (26)
Multiplying both sides of Equation (26) by (I - A), and then we get that
1
0
( ) ( ) ( ) ( ) ( )m
i m
i
I A P R I A A s I A s+
=
- × = - × × = - ×å (27)
It is not guaranteed that the infinite power of the matrix A would converge to 0, as shown
in the following equation:
1lim 0m
mA +
®¥= (28)
Here 0 is the zero matrix or null matrix in linear algebra. Some research papers established
sufficient conditions for the convergence of infinite product of matrix, e.g., in (Thomason 1977;
Holtz 2000; Daubechies and Lagarias 1992; Bru et al. 1994; Daubechies and Lagarias 2001). In
practice of project risk management, for example, if a risk is involved in several loops and the
sum of the products of all the transition probabilities along these loops is greater than 1, the
occurrence of this risk leads to chain reactions which will come back and trigger itself again
with a probability of more than 100%. In this way, the risk propagation process does not
converge. This type of risk propagation is not likely to occur in practice and is outside the
scope considered by our model.
Nevertheless, since A is the risk numerical matrix which is usually sparse and composed of
transition probabilities at small values less than 1, usually the condition of Equation (28) is
satisfied. Thus, risk probability can be re-evaluated by the following equation:
1( ) ( )P R I A s-= - × (29)
Moreover, it is possible to predict the consequences of the occurrence of one or more
initial risks. In this model, we assign for instance 100% to the spontaneous probability of Ri,
while all the other risks have 0% initial values. That is to say, the initial vector s = Ii, where Ii
is
the i-th column of the identity matrix I. We can then anticipate the occurrence of the rest of the
network, and thus evaluate the global consequences of Ri. Criticality is another important
indicator used for prioritizing risks and usually defined as the product of risk probability and
impact. Similar to risk probability, we can refine risk criticality by integrating all the potential
consequences in the network of a given risk. Giving Ri with its re-evaluated probability (risk
frequency) instead of 100%, we redefine its criticality by:
- 86 -
1
( ) ( ) ( )i
n
i j R jj
C R G R P R=
= ×å (30)
where C(Ri) is the criticality of Ri; G(Rj) is the original evaluated impact (G for gravity) of Rj;
and ( )iR jP R denotes the probability of Rj as the consequence of P(Ri). According to Equation
(29), the re-evaluated risk criticality is expressed by the equation:
1( ) ( ) ( ( ))T ii iC R G I A I P R-= × - × × (31)
The vector of risk criticalities can be calculated by the following equation:
1( ) ( ) .* ( )TC R I A G P R-= - × (32)
Here AT represents the transpose matrix of A; and the symbol “.*” denotes the array
multiplication or the Hadamard product (Johnson 1974) of matrices. For example, the
Hadamard product .*c a b= of two vectors a = [a1, a2, … , an] and b = [b1, b2, … , bn] is still an
n-order vector and its elements are defined as:
( ) ( ) ( )c i a i b i= × (33)
The re-evaluation of risk characteristics such as probability and criticality enables us to
update the risk prioritization results and then to develop new risk response plans.
5.1.3 A simple example for illustration
In this section we use a simple example to illustrate how to use the risk propagation model
for risk re-evaluation. Let us consider an example of a project with 7 identified risks. After the
modeling of risk interactions as described in Chapter 2, we get the RSM of the example (Figure
29) and the RNM with numerical values. The RNM is denoted by matrix A in Equation (34).
Figure 29. RSM and network structure of the example
- 87 -
0 0 0 0 0 0 0
0 0 0 0 0 0.08 0
0 0 0 0 0.15 0 0.125
0 0 0.25 0 0 0 0
0.32 0 0 0.28 0 0 0.09
0.42 0.39 0 0 0.22 0 0
0 0 0 0.22 0 0 0
A
é ùê úê úê úê ú
= ê úê úê úê úê úë û
(34)
To interpret this matrix, for example, A(4,3) = 0.25 indicates that if Risk 3 is activated,
then there is a transition probability of 25% originating from Risk 3 to trigger Risk 4. The
spontaneous probability vector and gravity vector of risks are obtained through evaluation by
classical methods, namely s and G given as follows:
[ ]0.350 0.220 0.220 0.170 0.080 0.010 0.010T
s = (35)
[ ]20.0 25.0 100.0 10.0 10.0 125.0 50.0T
G = (36)
Here the gravity values in G can be understood as potential impact of risks, such as
capitalized loss. We are able to calculate the risk propagation according to Equation (29), and
then get the re-evaluated risk probability vector:
[ ]1( ) ( ) 0.350 0.245 0.267 0.237 0.264 0.311 0.062T
P R I A s-= - × = (37)
Equally, risk criticalities are calculated using Equation (32). Risks are prioritized
according to different indicators. These refined results are consolidated and compared with
original estimates, as shown in Table 13.
Table 13. Risk re-evaluation and prioritization results of the simple example
By spontaneous
probability
By re-evaluated
probability
By classical
criticality
By re-evaluated
criticality Ranking
Risk ID Value Risk ID Value Risk ID Value Risk ID Value
1 R1 0.350 R1 0.350 R3 22.0 R6 40.7
2 R2 0.220 R6 0.311 R1 7.0 R1 32.5
3 R3 0.220 R3 0.267 R2 5.5 R3 29.5
4 R4 0.170 R5 0.264 R4 1.7 R2 18.6
5 R5 0.080 R2 0.245 R6 1.3 R5 14.6
6 R6 0.010 R4 0.237 R5 0.8 R4 9.6
7 R7 0.010 R7 0.062 R7 0.5 R7 4.3
From the results in Table 13, we can see that the probability of some risks has notably
increased after re-evaluation, such as R6 and R5. This kind of risks has little probability to
happen spontaneously, but some other events may lead to them. The risk prioritization results
have changed after taking into account risk interactions in the network. For example, in
classical method R3 was considered to be the most critical risk, but the one with the highest re-
- 88 -
evaluated criticality is R6. Moreover, in the new prioritization results, the value gap between
risks becomes different from that in the results of classical method. For instance, R5 and R7 are
two risks with low criticalities and R5 is ranked superior to R7. After re-evaluation, R5 is still
ranked superior to R7, but the gap between their relative criticality values becomes much larger.
This is the opposite for R3 and R2. R2 is still behind after re-evaluation, but closer.
5.2 Eigenstructure analysis on weighted risk network
The eigenstructure analysis proposed in Section 4.3 in the previous chapter for topological
analysis can be adapted to weighted risk network. We perform the eigenstructure analysis on
the RNM instead of RSM to measure the importance of project risks in the network.
Hence, ( ) ( , )ijA a RNM i j= = and aij denotes the strength of the edge j iE ® , i.e., the
transition probability from Rj to Ri. Let xi denote the importance score of the i-th node, we have
( ) ( ) 1
1 1 1( )
N
i ij j ji j ij ji jj P i j S i j
x a x a x a a xl l lÎ Î =
= × + × = +å å å (38)
where all the notations have the same meaning as in Section 4.3 while aij is no longer binary
but numerical such that
[ ]0,1ija Î (39)
In this way, besides the two principles of eigenvector centrality in the topological
viewpoint ((1) connections to more nodes contribute more to the score of the node; (2)
connections to high-scoring, namely important nodes, contribute more to the score of the node),
a third principle is included: (3) higher strength of the connection to other nodes contributes
more to the score of the node.
We can reformulate the Equation (38) as:
( )TA A x xl+ =
Similarly, we define the i-th element xi of the eigenvector corresponding to the largest * of RNM as the refined eigenvector centrality of Ri in the risk network.
5.3 Case studies
Both the musical staging project and the tramway construction project are used in this
section as case studies. The musical staging project is analyzed for validating the matrix-based
risk propagation model. On the other hand, both the risk propagation model and the numerical
eigenstructure analysis are carried out on the tramway construction project with 56 identified
risks.
- 89 -
5.3.1 Musical staging project
As described in Section 5.1.2, we use the risk propagation model to quantitatively
calculate the risk propagation. The re-evaluated risk characteristics are compared with the
related simulation results obtained in Chapter 3, shown in Table 14.
Table 14. Comparison of the results by risk propagation model and by simulation
Risk ID
Re-evaluated risk
probability by risk
propagation model
Risk frequency by
simulation
Re-evaluated risk
criticality by risk
propagation model
Risk global
criticality by
simulation
R01 0.808 0.807 26.04 25.88
R02 0.691 0.696 12.10 12.15
R03 0.769 0.771 9.43 9.53
R04 0.491 0.495 7.68 7.69
R05 0.360 0.364 11.09 11.36
R06 0.265 0.266 3.65 3.69
R07 0.430 0.425 6.61 6.55
R08 0.386 0.388 3.35 3.39
R09 0.050 0.049 0.89 0.85
R10 0.530 0.529 10.22 10.11
R11 0.394 0.393 4.74 4.75
R12 0.404 0.400 5.38 5.40
R13 0.389 0.383 5.47 5.34
R14 0.446 0.445 3.46 3.51
R15 0.192 0.196 3.04 3.11
R16 0.182 0.191 1.30 1.35
R17 0.471 0.469 4.02 4.05
R18 0.001 0.002 0.01 0.01
R19 0.011 0.014 0.19 0.24
According to Table 14, we can see that the risk re-evaluated results based on the proposed
risk propagation model are very similar to the corresponding results obtained by simulation.
Thus, we conclude that the risk propagation model is valid and useful in re-evaluating risk
characteristics taking into account risk interactions.
- 90 -
5.3.2 Tramway construction project
The project risk list (Table 8) and the risk network structure (Figure 21) of the tramway
construction project have been presented in Chapter 4. In order to apply the proposed approach
in this chapter, we assess the project risk network using the methods introduced in Section 2.2.
The direct assessment by experts is used on this case study for evaluating the strength of risk
interactions. The assessment of the potential risk interactions was then performed on a 10-level
Likert scale (Likert 1932; Maurer and Pierce 1998), due to the high expertise of interviewees.
Some difficulties while performing the assessment were encountered. In particular, this step
requires the participation of several experts involved in the project since it necessitates a very
wide overview of the project elements and stakes. In the end, the RNM of the project was
obtained. It is displayed in Figure 30. Various gray scales are used to indicate the strength
levels of the risk interactions.
Figure 30. RNM of the tramway project
In Table 15, we consolidate the risk analysis results by the risk propagation model and
compare them with the original risk estimates obtained by classical methods. In classical
project risk analysis, risks are ranked upon their criticality value which is defined as the product
of the evaluated probability and impact. Resources should be firstly allocated to manage the top
risks with priorities. In our risk propagation model, risk probability can be re-evaluated
through Equation (29) into risk frequency. As we can see in Table 15, the frequency of risks
has increased to varying extent taking into account the interactions with other risks in the
network. Some risks have high risk frequency which is greater than one. As we mentioned in
previous chapters, this is consistent with the reality that one risk may occur more than once
during the project. The examples are R2 (Liquidated damages on intermediate milestone and
- 91 -
delay of progress payment threshold), R43 (Return profit decrease) and R55 (Available cash
flow decrease). Shown in Figure 21 of the risk network structure, many risks lead to these risks
closely related to financial performance, consequently they have high probability to occur
during the project, and even more than one time (accumulation).
Risk criticalities can also be refined through Equation (32). As a result, the risk rankings
have also changed. From the column of ranking shift, we can see that some important risks
based on classical risk analysis remain in high positions, such as R43, R2, R55, R37 (Risk of
partial rejection of our request for extension of time)), R7 (Traffic signaling, priority at
intersections), R12 (Operating certificate delay), R18 (Civil Work delay & continuity). On the
other hand, some risks have dropped out of the top-ten rankings, such as R3 (Vehicle storage in
another city), R40 (OCS installation), R29 (Additional poles overcost for Tramway Company).
Several risks have greatly risen with respect to their rankings. For example, the ranking of R10
(Travel time performance) has increased from No.43 to No.10 with the upgrade of +33. The
shift of priorities reflects the intensity of risk interactions in the network.
- 92 -
Table 15. Project risk analysis results of the tramway project
Conducting the eigenstructure analysis by Matlab software, we get the unique largest real
e* = 1.4866 of the RNM. The eigenvector centralities (both based on the RSM and
RNM) of each risk are also given in Table 15. The top-ten risks with the highest eigenvector
centralities are listed in Table 16.
- 93 -
Since the eigenvector centrality conveys a relative score of risk importance in the network,
we put more emphasis on the risk rankings other than on the change of centrality values. In
Table 16, compared with the eigenvector centralities based on RSM, some new risks have
appeared in the top-ten list according to RNM-based eigenstructure analysis, such as R16
(Archeological findings), R44 (Extra trains) and R37 (Risk of partial rejection of our request
for extension of time). Some risk like R7 (Traffic signalling, priority at intersections) has also
risen in the list. This is due to their relatively strong interactions with other nodes (especially
important ones) in the network. For example, R16 have high-strength links with important risks
like R18 and R2 (RNM(18, 16) = 0.308 and RNM (2, 16) = 0.410); R44 have intense contacts
with important nodes like R10 as its predecessor (RNM(44, 10) = 0.410) and R43 as its
successor (RNM(43, 44) = 0.263); R7 is closely related with R2, R10, R12 which are all in the
top-ten list (RNM(2, 7 = 0.210, RNM(10, 7) = 0.347 and RNM(12, 7) = 0.347). The eigenvector
centrality provides a measurement of risks in terms of their positions and importance in the
network.
Table 16. Risk ranking results according to eigenvector centrality
Eigenvector Centrality based on RSM Eigenvector Centrality based on RNM Ranking
Risk ID Value Risk ID Value
1 R2 0.5124 R2 0.5553
2 R43 0.2990 R10 0.3248
3 R55 0.2901 R43 0.2980
4 R12 0.2703 R12 0.2971
5 R10 0.2155 R7 0.2384
6 R53 0.2055 R18 0.2235
7 R18 0.1997 R55 0.2075
8 R52 0.1981 R16 0.1996
9 R51 0.1660 R44 0.1746
10 R7 0.1646 R37 0.1726
5.4 Conclusion
Improving the analytical approach presented in Chapter 4 based on topological network
theory, in this chapter we propose a risk propagation model based on matrix calculation and
adapt the eigenstructure analysis to weighted risk network. Research questions Q1.2 and Q1.3
have been examined at a quantitative level. First, the parameters in the project risk network can
be assessed so that we are able to model and analyze the risk propagation behavior in the risk
network in a quantitative manner. Based on some assumptions, the RNM can be regarded as a
specific stochastic matrix describing the risk propagation process as the project progresses.
Thanks to the risk propagation model, risk characteristics such as probability and criticality can
be re-evaluated, which will lead to the update of risk prioritization.
- 94 -
The risk propagation model has been validated through the musical staging project case
study by comparing with the simulation results. As an improvement to the risk network
analysis in the previous Chapter 4, the proposed approach is applied to the tramway
construction project with respect to the assessed risk network. Under the original risk
propagation model for risk analysis, some risks have been upgraded in terms of criticality
ranking. Insights have been gained on the shift of risk rankings according to their position in
the network structure. The underestimation of some risks in classical methods is due to the
neglect of this complexity-related information.
The eigenvector centrality of risks is also refined taking into account the strength of risk
interactions. The changes in the top risks list help the project manager become more aware of
intense interactions related to the important risks. Thus, more efforts should be made to
enhance the communication between the corresponding risk owners.
This analysis can support project managers in designing more effective risk response
actions. However, budget and resources are always tight for project implementation and
particularly for managing risks as potential loss or threat to the project. For this reason, risk
response actions should be selected in order to minimize the negative risk exposure while
keeping the project within budget. The optimization of risk response plan under resource
constraints will be discussed in the next chapter.
- 95 -
Chapter 6 - Optimization of Risk Response
Plan under Resource Constraints
Abstract
In this chapter, a structured framework is presented for risk response planning under
resource constraints. It includes five steps: 1) building project risk network; 2) defining the
objective function; 3) identifying budget constraints; 4) identifying potential response actions;
and 5) optimizing risk response plan. Two heuristic algorithms are developed, aimed at
choosing response actions and optimizing the allocation of budget reserves dedicated to the risk
management.
The greedy algorithm, in each step, adds one action having the highest mitigation effects
into the portfolio, until there is not sufficient budget for any remaining action in the list. The
genetic algorithm encodes the risk response plan as a chromosome of bit string and starts the
search from a population of solutions. Integrating the budget constraint into the objective
function enables the project manager to make a balance between the total cost of actions and
their global effects on the risk network, by adjusting the parameters of the fitness function.
An example of application to the previously introduced tramway construction project is
presented. First, a risk response action list with 21 candidates is established, based on the
topological analysis of risk network (presented in Chapter 4) and the refined risk criticality
analysis (presented in Chapter 5). The results by using the two algorithms are compared. It
demonstrates that the genetic algorithm is more flexible and is more able to reach the global
optimal solution.
Chapter Keywords
Risk response planning, resource constrains, optimization, greedy algorithm, genetic
algorithm
- 96 -
6.1 An integrated framework for risk response planning
Managers of complex engineering projects face a challenge when deciding how to allocate
scarce resources to minimize the risks of project failure. As resource constraints become tighter,
balancing these risks is more critical, less intuitive, and can benefit from the power of
quantitative analysis (Dillon et al. 2003). To solve this problem, based on the methods for risk
network modeling and project risk analysis presented in the previous chapters, we introduce a
practical five-step framework for project risk response planning, illustrated in Figure 31. It
requires the involvement of the project manager and the team of experts in each step, to provide
their knowledge and expertise and to make decisions.
As described in Chapter 2, the DSM method is used to facilitate identifying and assessing
risk interactions, and thus to build the project risk network. This enables one to analyze the risk
propagation behavior in the network, and also to anticipate the global effects of mitigation
actions. Potential mitigation actions are proposed based on the project risk analysis results.
These include actions for reducing the probability or impact of risks, and actions for mitigating
the propagation through risk interactions. The expected costs of each potential action and the
total budget constraints are evaluated by the project manager and experts. The risk response
plan can be optimized based on different objective functions, whether local (e.g., mitigating the
exposure of some particular risks) or global (e.g., minimizing the total financial loss).
Optimization algorithms, for example, the genetic algorithm (GA) can be used to optimize the
risk response plan achieving the defined objective function subject to the identified resource
constraints.
The details of each step of the proposed framework will be introduced in the following
section.
- 97 -
Figure 31. A framework for risk response planning
6.2 Step-by-step for the optimization of project risk
response plan
6.2.1 Building project risk network
The process and methods of risk network modeling have been introduced in Chapter 2.
The simulation-based risk network model presented in Chapter 3 and the risk propagation
model introduced in Chapter 5 can be used to model propagation behavior in the risk network
and to test the potential candidate actions. The global effects of the mitigation actions on the
entire network can thus be anticipated, which is the foundation for the subsequent optimization
step.
- 98 -
6.2.2 Defining objective function
The objective of risk response planning depends on the nature of the project and the
manager’s point of view. Generally, risk response actions with allocated budget are conducted
to achieve two different goals: the local mitigation of particular risks, and the global risk
exposure mitigation of the risk network. For example, the objective function in the global sense
could be defined as follows:
min i ii
OF P G= *å (40)
where Pi and Gi indicate the probability and impact (G for gravity) of Risk i. The objective
would be to minimize the overall financial loss, if Gi expresses the financial value of Risk i.
6.2.3 Identifying budget constraints
Given the project scope, a budget reserve for project risk management is initially
established by the project manager. This budget is dependent on the total budget of the project,
the evaluated overall level of risk exposure, and also the risk attitudes of the stakeholders.
The budget for risk management BRM is normally comprised of three parts. Besides the
expense for performing risk analysis BRA (not significant compared with the other parts) and the
reserve for risk contingency BRC, the remaining budget is for the execution of the risk response
plan, and needs to be allocated to designed actions:
RM RA RCB B B B= - - (41)
Moreover, after the risk network analysis and the evaluation of the costs of actions in Step
4 (Figure 31), the budget for performing the risk response plan B can be adjusted, according to
the new knowledge on the risk management tasks.
6.2.4 Identifying potential response actions
Aiming at achieving the defined objectives for risk management, i.e., mitigating the global
risk exposure, potential response actions can be identified based on both the refined risk
criticality analysis taking into account risk propagation behavior (where risks are prioritized
with respect to their re-evaluated probability and impact), and also the topological analysis of
the risk network.
The response list includes different types of risk mitigation actions on risks and on the
interactions. These actions are, for instance, adopting less complex processes, conducting more
tests, enhancing internal communication, and choosing a more stable supplier, etc. Conducting
the response actions translates into changing the values of parameters of the risk network model.
For example, a classical mitigation action on a particular risk reduces its spontaneous
probability or impact; a complementary preventive action is to cut off the input links or reduce
their transition probabilities; blocking the output links can be regarded as the action of
confining the further propagation of such risk to subsequent risks.
- 99 -
Risk mitigation actions always consume time, money and other resources. In order to
perform the optimization, the cost of each identified action is evaluated by the project manager
and the expert team. Actions should be worthwhile, less expensive that the expected value of
the risk impact. Before the next step of optimization, the response action list shall be examined
by the project manager to make sure that unfeasible actions are not included in the possible
alternatives for optimization.
6.2.5 Optimizing risk response plan
For each identified risk response action in Step 4, the project manager can decide whether
to apply it or not. Given a list of n candidate actions, there are 2n-1 combinations for the risk
response plan aiming at mitigating the exposure of risks in the entire network (global objective
function). An exhaustive test of all the combinations is impractical for choosing the best risk
response plan. Considering the resource constraints, some heuristic algorithms can be exploited
to optimize the portfolio of response actions.
6.2.5.1 A greedy algorithm
A greedy algorithm is developed for the optimization of risk response plan under
constraints, following the problem solving heuristic of making the locally optimal choice at
each step with the hope of finding the global optimum (Cormen et al. 2001). In other words, we
choose at each step the action with the best test performance until the budget is completely
allocated. The process of the greedy algorithm is as follows:
- 100 -
However, the greedy algorithm for optimization under constraints can usually achieve only
a local optimal solution. Namely, it may make commitments to certain choices too early which
prevent it from finding the best overall solution later. For example, choosing an action with
good effects but high cost in early stage would largely squeeze the remaining budget space and
possibly sacrifice the opportunity of involving a combination of several low-cost actions in the
portfolio.
6.2.5.2 A genetic algorithm
Genetic algorithm (GA) is a stochastic search method introduced by Holland in 1970s
(Holland 1975). It has a wide range of applications, for example, to the optimization of system
reliability (Marseguerra et al. 2006), index fund portfolio management (Oh et al. 2005) and
project scheduling (Hartmann 2002).
Identify the budget constraint B;
Prepare the action list L;
Create the portfolio of actions A =Æ ;
WHILE L ¹ Æ DO
BEGIN
FOR each iA LÎ
IF the cost of Ai exceeds the remaining budget B ( ( )iC A B> )
Remove Ai from L ( \ iL L A= );
ELSE
Test the global mitigation effects of iA AU in the risk network model;
END
END
Choose the best candidate Ai*;
Add Ai* into A ( *
iA A A= U );
Remove Ai* from L ( *\ iL L A= );
Allocate the corresponding amount of budget ( *( )iB B C A= - );
END
RETURN A as the optimized portfolio of actions;
- 101 -
In our study, a genetic algorithm is devised for the optimization of project risk response
plan. It is able to get the global optimum or at least a near global optimal portfolio of actions by
starting the search from a population of solutions. The budget constraint is integrated into the
objective function (fitness) calculation and the algorithm allows random operations like
mutation (Holland 1975). The co-effects (positive and negative synergy effects) of actions are
taken into account because an entire portfolio is tested in the risk network model rather than
single actions.
The basic genetic algorithm-based optimization process is described as follows:
1) Basic Scheme
2) Representation
A risk response plan is suitable to be encoded as a chromosome in the GA, represented as
a string of bits. Each bit {0,1}ix Î in the chromosome x indicates whether the corresponding
action Ai is chosen or not.
1 2 1x={x ,x ,...x ,...x ,x }i n n- (42)
3) Fitness
We integrate the budget constraint into the optimization problem as an objective, which
leads to the following definition of fitness:
min ( ( )+(1 )( / )i ii
Fitness P G C B bl l a= * -å (43)
GEN = 1;
Create initial population POP;
WHILE GEN < GEN* AND (Not Terminate-Condition) DO
BEGIN
GEN = GEN + 1;
Test in the risk network model, and compute fitness for individuals I POPÎ ;
Selection of parents PAs from POP;
Produce children CHs from PAs by Crossover;
Mutation operation on children sI CHÎ ;
sPOP POP CH= U ;
Reduce POP by fitness ranking;
END
- 102 -
Here C is the total cost of the action plan; Pi and Gi are the probability and impact of Risk
i after the response plan is performed. The penalty value ( / )C B ba will exponentially increase
if the allocated costs C exceed Ba ( 0 1a< £ ), e.g., 90% of the budget constraint. Thus,
breaking constraints is penalized by the significant decrease of fitness. The parameter
1b > reflects the project manager’s degree of aversion to budget overruns. The project manager
can adjust the parameter [0,1]lÎ to balance the trade-off between budget constraints and
mitigation effects.
4) Initial population
The initial population of individual solutions can be created randomly, of given size M.
Each of these individuals is a possible risk response plan. Population diversity should be
encouraged to make the search more efficient (Nsakanda et al. 2007).
5) Selection of the parents
During each successive generation, a proportion of the existing population is selected to
breed a new generation. Individual solutions are selected through a fitness-based process,
where fitter solutions (as measured by the fitness function) are typically more likely to be
selected. We employ the Roulette Wheel Selection (Fogel 1994; Rajkumar and Shahabudeen
2009) method, where the chance of selecting a chromosome is proportional to its fitness. The
rule is that the chromosome ix is selected if:
1
1 1
1 1
( ) ( )
( ) ( )
i i
j jj j
M M
j jj j
f x f xr
f x f x
-
= =
= =
< £å åå å
(44)
where M is the given population size; ( )jf x is the fitness value of the chromosome jx ; and r is
the generated random number with ( ]0,1rÎ .
6) Crossover and mutation
Crossover operation combines two individuals, or parents, to form a new individual, or
child, for the next generation. The GA employs a conventional scattered crossover (Popov
2005). It creates a random binary vector as bit mask. It selects the genes where the mask bit is
‘1’ from parent1, and the genes where the mask bit is ‘0’ from parent2, and combines the genes
to form the child. The example in Figure 32 illustrates the process of crossover. It should be
noted that the symbols a~h and 1~8 are all replaced by a binary bit in this study. The crossover
fraction specifies the portion of the next generation, other than elite individuals (the number of
individuals that are guaranteed to survive to the next generation), that are produced by
crossover.
- 103 -
Figure 32. Illustration of the crossover operation
Mutation functions make small random changes in the individuals in the population, which
provide genetic diversity and enable the GA to search a broader space (Goldberg 1989). The
mutation rate is the chance that a bit within a chromosome will be reversed (0->1, 1->0). The
mutation is performed on the basis of an assigned mutation rate for a single bit, which is
usually very low for binary encoded genes (Senouci and Al-Derham 2008).
7) Reduction of population for the next generation
The fitness ranking is used for reducing the population to form the next generation. The
individuals with the worst test performance are removed in order to return the population to its
original size M (Marseguerra et al. 2006).
8) Termination condition
The iteration of GA is terminated when the a-priori fixed number of generations GEN* is
reached, or the highest ranking solution's fitness has reached a plateau such that the successive
iterations no longer improve the results.
6.3 Case study
We apply the proposed approach to the tramway construction project, which has been
introduced and analyzed in the previous Chapters 4 and 5. The aim is to optimize the risk
response plan for minimizing the global objective function in Equation (40):
min i ii
OF P G= *å . The risk propagation model presented in Chapter 5 is used to test the
mitigation actions and anticipate their effects on the risk network.
6.3.1 Build the action list
Based on the risk analyses results, with the help of the project management team, we
propose a list of potential risk mitigation actions, shown in Table 17. The list contains 21
identified potential actions after eliminating some unfeasible ones. These actions are designed
based on the risk criticality analysis (in Chapter 5), topological analysis of risk network (in
Chapter 4), or based on both of them. The designed actions are intended to mitigate the risks
- 104 -
(reduce risk spontaneous probability or risk impact) or the risk interactions (reduce transition
probability between risks). The cost of executing the actions is estimated by the project
manager and some experts. The local effects of the mitigation actions are also evaluated at the
qualitative level. Probabilistic effects can be converted into quantitative values through
Equation (1): ( )
10 spb
a-
= * , where the parameters are set as 0.8, 2.9a b= = by experience.
Table 17. The list of potential risk response actions
- 105 -
6.3.2 Greedy algorithm results
The devised greedy algorithm is used to obtain the optimal portfolio of mitigation actions.
Given the budget reserve for implementing the risk response plan B = 300 k€, we get the
optimization results shown in Table 18.
In each round, one mitigation action with the highest added effects on the risk network is
included into the current portfolio, until the remaining budget reserve is not sufficient for any
remaining candidate in the action list. Finally, we get an optimal portfolio containing 11 actions:
A* = [A1, A2, A3, A4, A5, A6, A8, A9, A12, A13, A16], with the total cost of 295 k€. The
value of the objective function has been reduced to 43.599 if all these actions are implemented.
Table 18. Optimization results using the greedy algorithm
Round Chosed
Action ID
Cost
(k€)
Objective
Function
Value
Added
Effects Current Portfolio
Allocated
Budget (k€)
Original
Status No 0 63.128 0.000 [No action] 0
1 A16 40 59.572 -3.556 [A16] 40
2 A5 20 56.521 -3.051 [A16,A5] 60
3 A9 5 54.367 -2.154 [A16,A5,A9] 65
4 A2 10 52.558 -1.808 [A16,A5,A9,A2] 75
5 A4 20 50.777 -1.781 [A16,A5,A9,A2,A4] 95
6 A6 10 49.222 -1.555 [A16,A5,A9,A2,A4,A6] 105
7 A1 40 47.910 -1.313 [A16,A5,A9,A2,A4,A6,
A1] 145
8 A8 20 46.641 -1.269 [A16,A5,A9,A2,A4,A6,
A1,A8] 165
9 A13 60 45.434 -1.208 [A16,A5,A9,A2,A4,A6,
A1,A8,A13] 225
10 A12 20 44.424 -1.009 [A16,A5,A9,A2,A4,A6,
A1,A8,A13,A12] 245
11 A3 50 43.599 -0.825 [A16,A5,A9,A2,A4,A6,
A1,A8,A13,A12,A3] 295
In the greedy algorithm, actions with the highest performance in terms of decreasing the
global objective function are always firstly chosen. In this sense, additional budget will not
change the previous choices of actions, but only add new actions. Similarly, decreasing the
budget reserve will only affect the last few actions added in the portfolio.
- 106 -
6.3.3 Genetic algorithm results
The developed genetic algorithm is performed for the optimization of risk response plan.
The population size is set to 100, namely there are 100 individuals in each generation. Roulette
wheel method is used for selecting the parents for the next generation. The crossover fraction is
set to 0.8, and the mutation rate is set to 0.01. The termination condition of the algorithm is
either 1) the iterations of the algorithm reach the maximum number of generations which is set
to 100; or 2) there is no improvement in the best fitness value for the number of successive
generations, specified by Stall Generations which is set to 20.
For the parameters of the optimization problem (parameters in Equation (43) of the fitness
function), we set =0.9l , =0.95a and =20b by experience and test. In this context, the
algorithm stops at the 48th generation and we get the best individual with the chromosome x =
[1, 1, 0, 1, 1, 1, 1, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0]. It has the best fitness value equal to
39.373. The decoded optimal portfolio is A* = [A1, A2, A4, A5, A6, A7, A8, A9, A12, A13,
A16, A20]. The total cost of implementing the action plan A* is 295 k€. It may reduce the
objective function to the value at 43.527.
Compared with the results by the greedy algorithm (shown in Table 19), we find that in
the optimal solution, the action A3 has been replaced by the combination of A7 and A20. In
this case, the required budget for the portfolio is the same, but the optimal risk response plan
generated by the genetic algorithm has better effects on the objective function in terms of
mitigating the global risk exposure. Although the improvement is not significant for this
example, it still shows that the genetic algorithm has greater ability to reach the global optimum
than the greedy algorithm for this optimization problem.
Table 19. Comparison of the results by the greedy and genetic algorithms
Method Optimal Portfolio Number of
Actions
Required
Budget (k€)
Objective
Function Value
Greedy
Algorithm
[A1, A2, A3, A4, A5, A6,
A8, A9, A12, A13, A16] 11 295 43.599
Genetic
Algorithm
[A1, A2, A4, A5, A6, A7,
A8, A9, A12, A13, A16,
A20]
12 295 43.527
Furthermore, the parameters can be altered to reflect the adjustment of strategy for risk
response planning. For example, if we set 0.8l = to strengthen the control over budget, the
best chromosome x = [1, 1, 0, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 0], and the optimal
portfolio is A* = [A1, A2, A4, A5, A6, A8, A9, A12, A13, A16, A20]. We can see that A7 has
been removed from the action plan so that the required budget has decreased to 265 k€ while
maintaining the objective function value at 43.872.
On the other hand, if we increase the balance factor 0.95l = for emphasizing the
mitigation effects, the best chromosome x = [1, 1, 1, 1, 1, 1, 0, 1, 1, 0, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1,
- 107 -
0], and the optimal portfolio is A* = [A1, A2, A3, A4, A5, A6, A8, A9, A12, A13, A16, A20].
In this case, A3 has replaced the place of A7. As a result, the objective function has improved
to the value at 43.047. However, extra budget is required to achieve such expectation, where
the total cost for executing the risk response plan is accumulated to 315 k€.
6.4 Conclusion
This chapter presents a practical framework for decision support in risk response planning.
The aim is to provide the project manager with a solution and quantitative methods to deal with
Q2.3 (how to allocate scarce resources for mitigating risks). First, building the risk network
model makes it possible to analyze risk propagation behavior and anticipate the effects of
response actions on the global risk network. The objectives of the risk response plan need to be
clearly defined before carrying out the risk management activities. Project risk analyses
introduced in the previous chapters can be relied on to design potential response actions so that
an action list can be established. In this step, some impractical actions should be screened out
by the project manager. The re-evaluation of risks and new understandings of the risk network
may help the project manager adjust the budget constraints for risk management. Selecting the
best risk response plan from many options based on the action list is often required. A greedy
algorithm and a genetic algorithm are thus developed to optimize the risk response plan
achieving the defined objective function subject to the identified budget constraints.
An application based on a transportation construction project is provided to demonstrate
the utility of the approach. A list containing 21 potential risk mitigation actions is built based
on the risk analysis results. The cost of each action is estimated by the project management
team and the budget reserve for risk management is given as 300k€. Using the greedy
algorithm, we obtain an optimal portfolio of 11 actions within the budget. Increasing or
decreasing the budget will only add some new actions or remove the last few actions selected.
The deficiency of the greedy algorithm is that only the effect rather than the cost of actions is
considered as the basis for local searches, which may prevent it from finding the global optimal
solution.
In the developed genetic algorithm, we integrate the budget constraint into the objective
function to form the fitness function. Through testing the entire response plans in the risk
network model, it considers the synergy effects of actions in reaching the optimal solution. The
genetic algorithm generates a superior portfolio of actions, which requires the same budget but
has better mitigation effects on the risk network. By adjusting the parameters of the fitness
function, the project manager is able to make a trade-off between the better risk management
results and the budget invested on it.
There are some potential improvements of the proposed framework and algorithms. We
only consider the objective of mitigating the global risk exposure under the budget constraints.
However, the stakeholders’ or the project manager’s preferences should also be included into
the risk response planning process. For example, sometimes the mitigation of several particular
risks is mandatory. Moreover, the portfolio of actions may be more complex. In practice, for
- 108 -
example, if more funds are allocated on the reinforcement of a component, the probability of its
failure risk will decrease. In this sense, an action for mitigating risks, for example, A2 can be
subdivided into several alternatives (e.g., A2.1, A2.2, and A2.3) with different levels of cost,
which will undoubtedly generate different levels of mitigation effects. In this case, we need not
only to decide whether to choose an action or not, but also to optimize the level of investment
on each action and related risk.
- 109 -
Chapter 7 - Conclusions and Perspectives
This Ph.D. thesis is a synthesis of related research, aiming at modeling and managing the
complexity of project risks. As a whole, an original framework of decision support system for
project risk management is presented. It consists of five phases: risk network identification, risk
network assessment, risk network analysis, risk response planning, and risk monitoring and
control. The development and use of the DSS requires the involvement of the project manager,
related experts and other team members assigned to the risk management process. The
proposed structured approach improves the classical process of PRM and supports decision-
making to achieve proactive risk management. A series of methods and tools are provided to
the project manager with regard to each phase of the DSS. The research questions posed in S1.4
in Chapter 1 have been addressed.
As a result of the increasing complexity of projects, project risks become interdependent
and their consequences may propagate from one risk to another in a complex network structure.
The complexity of risk network causes the difficulty for the project manager to properly
evaluate risks in terms of characteristics such as probability, impact and criticality. This may
limit the project manager’s ability to make reliable decisions with respect to risk management.
To model the dependency relationships of risks, first, project risks are identified and assessed
by classical methods of PRM; then some sophisticated methods like Design Structure Matrix
(DSM) and Analytic Hierarchy Process (AHP) are used to identify and assess risk interactions.
This makes us able to build the interactions-based risk network, which represents the real
complexity of project risks. An example of application to a real musical staging project in the
entertainment industry is provided to illustrate the process of project risk modeling.
A prototype risk network model is run using simulation techniques to imitate the
occurrence of risks and risk propagation behavior. This enables the project manager to re-
evaluate risks in terms of frequency, impact and criticality, taking into account risk interactions.
Based on the updated risk prioritization, new risk mitigation actions are suggested and tested,
including: (1) classical mitigation actions, but applied to risks with re-evaluated values and
rankings (simulated values may be different from initial estimations); (2) non-classical
mitigation actions, which mitigate risk propagation instead of risk occurrence. Thus, the
simulation-based risk network model can support project manager in making decisions with
respect to risk response actions. The application to the musical staging project demonstrates the
effectiveness of this prototype model.
Furthermore, based on the project risk network, some innovative methods for project risk
analysis are introduced. First, a network theory-based topological analysis is presented for
analyzing the structural properties of the risk network. Tailoring some network theory-based
indicators to the project risk network, we are able to identify key factors with respect to their
- 110 -
roles in the risk network. Particularly, identifying the interfaces between domains or owners
gives the project manager knowledge for improving the structure of organization. For example,
reassignment can be performed with the purpose of reducing the interfaces between different
risk owners. Second, an eigenstructure analysis is introduced and performed based on both the
topological structure and the weighted risk network which assesses the strength of risk
interactions. The aim is to measure the importance of risks in the network. This measurement
reflects the influence of a risk taking into account both its direct and indirect connections with
the other risks in the network. Third, a matrix-based risk propagation model is introduced. It
can be used to quantitatively calculate risk propagation and thus to re-evaluate risk
characteristics. This model is validated through comparing with the simulation results. It is also
an alternative of the simulation-based risk network model for analyzing risk propagation
behavior and testing the effects of response actions. These new project risk analyses serve as a
powerful complement to classical project risk analysis. The outcomes provide the project
manager with more and new insights on risks and risk interactions in the network, which
support in designing more effective risk response actions. An application to a real complex
engineering project, an urban transportation system implementation project, is presented to
illustrate the usefulness of these proposed project risk analyses.
Finally, a practical framework is presented for risk response planning under resource
constraints. Two heuristic algorithms are developed, aimed at choosing response actions and
optimizing the allocation of budget reserves dedicated to the risk management. This approach is
applied to the tramway construction project. Compared with the greedy algorithm, the genetic
algorithm-based method shows its greater ability to obtain the global optimal solution. By
integrating the budget constraint into the objective function, the project manager can make a
trade-off between the expected mitigation effects and the estimated costs using the genetic
algorithm.
Some expected improvements have been discussed at the end of each chapter. There are
still some limitations and potential extensions of the work in this Ph.D. thesis. The perspectives
in the future work are described as follows.
1) Design-oriented research and development
This thesis mainly aims at addressing the posed research questions due to the introduction
of complexity for PRM, and an effort has been made to propose a series of methods/tools at the
academic level. However, a more design-led and rigorous research approach would enhance the
robustness of the research and the development of methods/tools with respect to practical usage
in industry. For example, the design research methodology proposed in (Blessing and
Chakrabarti 2009) can be considered for improving this study.
- 111 -
2) Sensitivity analysis
As we discussed in Chapter 3, the effectiveness of the risk network model also depends on
the validity of the input estimations. A preliminary sensitivity analysis is conducted to examine
the effects of input uncertainties on the analysis results. Aven and Zio discusses the challenges
involved in the representation and treatment of uncertainties in risk assessment, with regard to
decision support (Aven and Zio 2011). This provides some guidance for our future work on the
modeling of input assessment uncertainties and their propagation in the risk network for PRM.
For example, some possibility theory and fuzzy logic-based methods might be exploited on this
issue.
3) Positive risks in terms of opportunity
In this thesis, only the conventional negative risks are included in the scope of the study on
PRM. In the future work, risks with positive effects will be considered and included in the
network, such as risks with positive impact or so-called opportunities like surplus budget and
some conditions like good team communication, which may mitigate some other negative risks.
4) Dependency of risk interactions
In this thesis, the identified risk interactions are assumed to be independent. However,
sometimes the effect of an interaction is influenced by other related interactions. To address this
limitation, more identification work about cross-impact between risk interactions by experts
and decision-makers is required.
5) Dynamic risk network with monitoring and control
In practice, there exist potential changes in the project and uncertainties in the external
environment as the project advances. In this regard, more research is needed to analyze the
dynamics of the network of interacting risks. The risk network should be monitored and
periodic reviews conducted, which may lead to the identification of new risks, termination of
the lifecycle of some risks, update of analysis results, and evaluation of the effectiveness of the
implemented actions. Thus, the risk analysis report and risk response plans can be modified and
improved.
6) Extension of applications
The proposed decision support system will be applied to projects in different industries
and with different levels of complexity. Moreover, beyond the context of project management,
this approach and some original methods may find their usefulness in other research areas
concerning risk management, e.g., critical infrastructures.
112
113
Publications
International journals with scientific committee review
Fang. C and Marle. F (2012), “A simulation-based risk network model for decision support in
project risk management”, Decision Support Systems, 52(3), 635-644.
Fang. C, Marle. F, Zio. E and Bocquet. J.C, “Network theory-based analysis of risk
interactions in large engineering projects”, accepted paper, to appear in Reliability Engineering &
System Safety.
Fang. C and Marle. F, “Dealing with project complexity by matrix-based propagation
modelling for project risk analysis”, under 2nd
round review, submitted to Journal of Engineering
Design: Special Issue on Dependency Modelling in Complex System Design. (Submission Nov.
2011)
International conferences with scientific committee review
Fang. C, Marle. F and Zio. E, “An integrated framework for the optimization of project risk
response plan under resource constraints with genetic algorithm”, presented at IEEE conference in
Quality, Reliability, Risk, Maintenance, and Safety Engineering, June 2011, Xi’an, China.
Fang. C and Marle. F, “Un modèle de simulation des interactions entre risques pour assister
le management des risques projet”, presented at Congrès Lambda Mu 17 Innovation et Maitrise
des Risques, Oct. 2010, La Rochelle, France.
Fang. C, Marle. F and Vidal. L.A, “Modelling risk interactions to re-evaluate risks in project
management”, presented at the 12th International Dependency and Structure Modelling
Conference, DSM’10, July 2010, Cambridge University, UK.
Fang. C and Marle. F, “Interactions-based risk network simulation for project risk
prioritization”, presented at the PMI (Project Management Institute) Research and Education
Conference, July 2010, Washington D.C., USA.
Fang. C and Marle. F, “Modeling and simulation of risk interactions in project management”,
presented at the conference Confere’09, July 2009, Marrakech, Morocco.
114
115
Bibliographies
Adla, A., Soubie, J. L., & Zarate, P. (2007). A cooperative intelligent decision support system for
boilers combustion management based on a distributed architecture. Journal of Decision
Systems (JDS), 16(2), 241-263.
AFNOR (2003). Fd x 50-117: Management de projet, gestion du risque, management des risques
d’un projet: AFNOR.
Albert, R., & Barabási, A. L. (2002). Statistical mechanics of complex networks. Reviews of
modern physics, 74(1), 47.
Albert, R., Jeong, H., & Barabási, A. L. (2000). Error and attack tolerance of complex networks.
Nature, 406(6794), 378-382.
APM (1996). Project risk analysis & management (pram) guide (2nd edition ed.). High Wycombe:
ASSOCIATION FOR PROJECT MANAGEMENT.
Arnott, D., & Pervan, G. (2008). Eight key issues for the decision support systems discipline.
Decision Support Systems, 44(3), 657-672.
Austin, S., Newton, A., Steele, J., & Waskett, P. (2002). Modelling and managing project
complexity. International Journal of Project Management, 20, 191-198.
Aven, T., & Zio, E. (2011). Some considerations on the treatment of uncertainties in risk
assessment for practical decision making. Reliability Engineering & System Safety, 96(1),
64-74.
Baccarini, D. (1996). The concept of project complexity – a review. International Journal of
Project Management, 14(4), 201-204.
Baccarini, D., & Archer, R. (2001). The risk ranking of projects: A methodology. International
Journal of Project Management, 19(3), 139-145.
116
Banks, J., Carson, J. S., Nelson, B., & Nicol, D. (2009). Discrete-event system simulation (5th
Edition ed.): Prentice Hall.
Belevitch, V. (1968). Classical network theory: Holden-Day.
Bhat, U. N., & Miller, G. K. (2002). Elements of applied stochastic processes (Vol. 378): Wiley-
Interscience.
Blessing, L. T. M., & Chakrabarti, A. (2009). Drm, a design research methodology: Springer
Verlag.
Bonacich, P. (1972). Factoring and weighting approaches to status scores and clique identification.
Journal of Mathematical Sociology, 2(1), 113-120.
Bonacich, P. (2007). Some unique properties of eigenvector centrality. Social Networks, 29(4),
555-564.
Bondy, J. A., & Murty, U. S. R. (1976). Graph theory with applications (Vol. 290): MacMillan
London.
Borgatti, S. P. (2005). Centrality and network flow. Social Networks, 27(1), 55-71.
Boulding, K. E. (1956). General systems theory-the skeleton of science. Management Science, 3(3),
197-208.
Bowles, J. The new sae fmeca standard. In IEEE (Ed.), PROCEEDINGS Annual RELIABILITY
and MAlNTAINABlLITY Symposium, 1998
Browning, T. (2001). Applying the design structure matrix to system decomposition and
integration problems: A review and new directions. IEEE Transactions in Engineering
Management, 48(3), 292-306.
Bru, R., Elsner, L., & Neumann, M. (1994). Convergence of infinite products of matrices and
inner–outer iteration schemes. Electronic Transactions on Numerical Analysis, 2, 183-193.
BSI (2002). Iso/iec guide 73:2002. Risk management – vocabulary – guidelines for use in
standards. London: BRITISH STANDARD INSTITUTE.
117
Bui, T., & Lee, J. (1999). An agent-based framework for building decision support systems.
Decision Support Systems, 25(3), 225-237.
Buzacott, J. A., & Shanthikumar, J. G. (1993). Stochastic models of manufacturing systems:
Prentice Hall Englewood Cliffs, NJ.
Carayannis, E. G., Kwak, Y. H., & Anbari, F. T. (2005). The story of managing projects: An
interdisciplinary approach: Greenwood Publishing Group.
Carr, V., & Tah, J. H. M. (2001). A fuzzy approach to construction project risk assessment and
analysis: Construction project risk management system. Advances in Engineering Software,
32(10-11), 847-857.
Chapman, C., & Ward, S. (2003). Project risk management – processes, techniques and insights.
Chichester: John Wiley & Sons.
Chapman, R. (2001). The controlling influences on effective risk identification and assessment for
construction design management. International Journal of Project Management, 19, 147-
160.
Chu, D., Strand, R., & Fjelland, R. (2003). Theories of complexity – common denominators of
complex systems. Complexity, 8(3).
Cleland, D. I., & Gareis, R. (2006). Global project management handbook: McGraw-Hill.
Cleland, D. I., & King, W. R. (1983). Systems analysis and project management: MCGRAW-
HILL.
Cooper, D. F., & Chapman, C. B. (1987). Risk analysis for large projects: Model, methods and
cases. Chichester, New-York.
Corbett, L. M., Brockelsby, J., & Campbell-Hunt, C. (2002). Tackling industrial complexity.
Cambridge: Cambridge: Institute for Manufacturing.
Cormen, T. H., Leiserson, C. E., Rivest, R. L., & Stein, C. (2001). Introduction to algorithms (2nd
ed.): MIT Press.
Crucitti, P., Latora, V., & Porta, S. (2006). Centrality in networks of urban streets. Chaos: an
interdisciplinary journal of nonlinear science, 16, 015113.
118
Danilovic, M., & Browning, T. (2007). Managing complex product development projects with
design structure matrices and domain mapping matrices. International Journal of Project
Management, 25, 300-314.
Daubechies, I., & Lagarias, J. C. (1992). Sets of matrices all infinite products of which converge.
Linear algebra and its applications, 161, 227-263.
Daubechies, I., & Lagarias, J. C. (2001). Corrigendum/addendum to: Sets of matrices all infinite
products of which converge. Linear Algebra and its Applications, 327(1-3), 69-83.
Dean, B. V. (1985). Project management: Methods and studies (Vol. 11): Elsevier Science Ltd.
Deo, N. (2004). Graph theory with applications to engineering and computer science: PHI
Learning Pvt. Ltd.
Dillon, R. L., Pate-Cornell, M. E., & Guikema, S. D. (2003). Programmatic risk analysis for
critical engineering systems under tight resource constraints. Operations Research, 354-
370.
Dong, Q. (2002). Predicting and managing system interactions at early phase of the product
development process. MIT,
DSM-Community (2009). Dsm tutorial. http://www.dsmweb.org/.
Ebrahimnejad, S., Mousavi, S. M., & Seyrafianpour, H. (2010). Risk identification and assessment
for build-operate-transfer projects: A fuzzy multi attribute decision making model. Expert
Systems with Applications, 37(1), 575-586.
Eckert, C., Clarkson, P. J., & Zanker, W. (2004). Change and customisation in complex
engineering domains. Research in Engineering Design, 15(1), 1-21.
Edmonds, B. (1999). Syntactic measures of complexity. philosophy University of Manchester,
Manchester.
Eppinger, S., & Salminen, V. Patterns of product development interactions. In International
Conference on Engineering Design, Glasgow, Scotland, 2001
119
Eppinger, S., Whitney, D. E., & Gebala, D. A. Organizing the tasks in complex design projects:
Development of tools to represent design procedures. In NSF Design and Manufacturing
Systems Conference, Atlanta GA, 1992 (pp. 301-309)
Eusgeld, I., Kröger, W., Sansavini, G., Schläpfer, M., & Zio, E. (2009). The role of network theory
and object-oriented modeling within a framework for the vulnerability analysis of critical
infrastructures. Reliability Engineering & System Safety, 94(5), 954-963.
Fan, C., & Yu, Y. (2004). Bbn-based software project risk management. Journal of Systems and
Software, 73(2), 193-203.
Fleiss, J. L. (1981). Statistical methods for rates and proportions. New York: John Wiley&Sons.
Floyd, R. W. (1962). Algorithm 97: Shortest path. Communications of the ACM, 5(6), 345.
Fogel, D. B. (1994). An introduction to simulated evolutionary optimization. Neural Networks,
IEEE Transactions on, 5(1), 3-14.
Freeman, L. C. (1977). A set of measures of centrality based on betweenness. Sociometry, 40(1),
35-41.
Friedkin, N. E. (1991). Theoretical foundations for centrality measures. American journal of
Sociology, 1478-1504.
Frobenius, G. F., Frobenius, F. G., Frobenius, F. G., & Frobenius, F. G. (1912). Über matrizen aus
nicht negativen elementen: Königliche Akademie der Wissenschaften.
Gachet, A., & Haettenschwiler, P. (2003). A jini based software framework for developing
distributed cooperative decision support systems. Software: Practice and Experience,
33(3), 221-258.
Gautier, R., Truchot, P., & Gidel, T. (1997). Method of reliability analysis in the project
information management process. In Managing risks in projects (pp. pp.195-203).
London: A&FN SPON.
Giffin, M., De Weck, O., Bounova, G., Keller, R., Eckert, C., & Clarkson, P. J. (2009). Change
propagation analysis in complex technical systems. Journal of Mechanical Design, 131,
081001.
120
Goldberg, D. E. (1989). Genetic algorithms in search, optimization, and machine learning:
Addison-wesley.
Guimera, R., & Amaral, L. A. N. (2004). Modeling the world-wide airport network. The European
Physical Journal B-Condensed Matter and Complex Systems, 38(2), 381-385.
Gunawan, I., & Ahsan, K. (2010). Project scheduling improvement using design structure matrix.
International Journal of Project Organisation and Management, 2(4), 311-327.
Hadi, A. S. (1992). A new measure of overall potential influence in linear regression.
Computational statistics & data analysis, 14(1), 1-27.
Hartmann, S. (2002). A self-adapting genetic algorithm for project scheduling under resource
constraints. Naval research logistics, 49(5), 433-448.
Heal, G., & Kunreuther, H. (2007). Modeling interdependent risks. Risk Analysis, 27(3), 621-634.
Hendrickson, C., & Au, T. (2000). Project management for construction. Prentice Hall.
Henley, E., & Kumamoto, H. (1992). Probabilistic risk assessment. New York: IEEE Press.
Holland, J. H. (1975). Adaptation in natural and artificial systems: An introductory analysis with
applications to biology, control, and artificial intelligence: U Michigan Press.
Holtz, O. (2000). On convergence of infinite matrix products. Electron. J. Linear Alg, 7, 178–181.
IEC (1995). Cei/iec 300-3-9:1995 risk management: Part 3 – guide to risk analysis of
technological systems. Geneva: INTERNATIONAL ELECTROTECHNICAL
COMMISSION.
IEEE (2001). Ieee standard 1540-2001: Standard for software life cycle processes – risk
management. New York: INSTITUTE OF ELECTRICAL AND ELECTRONIC
ENGINEERS.
IPMA (2006). Ipma competence baseline (icb), version 3.0, march 2006 International Project
Management Association.
ISO (2003). Iso 10006 - quality management systems - guidelines for quality management in
projects (2nd edition ed.). Switzerland: International Organization for Standardization.
121
Johnson, C. R. (1974). Hadamard products of matrices. Linear and Multilinear Algebra, 1(4), 295-
307.
Jones, B. S., & Anderson, P. (2005). Diversity as a determinant of system complexity. GIST
technical report G 2005-1.
Kaplan, S., Vishnepolschi, S., Zlotin, B., & Zusman, A. (1999). New tools for failure and risk
analysis, anticipatory failure détermination (afd) and the theory of scenario structuring.
South-field, Michigan: Monograph published by Ideation International Inc.
Katz, L. (1953). A new status index derived from sociometric analysis. Psychometrika, 18(1), 39-
43.
Kawakita, J. (1991). The original kj method Tokyo: Kawakita Research Intitute.
Keizer, J., Halman, J., & Song, M. (2002). From experience: Applying the risk diagnosing
methodology. The journal of product innovation management, 19(3), 213-232.
Kelton, W., Sadowski, R., & Sturrock, D. (2007). Simulation with arena (4th Edition ed.). New
York: McGraw Hill.
Kerzner, H. (1998). Project management: A systems approach to planning, scheduling and
controlling New York: John Wiley & Sons.
Klein, J., & Cork, R. (1998). An approach to technical risk assessment. International Journal of
Project Management, 16, 345-351.
Kloss-Grote, B., & Moss, M. A. (2008). How to measure the effectiveness of risk management in
engineering design projects? Presentation of rmpass: A new method for assessing risk
management performance and the impact of knowledge management—including a few
results. Research in Engineering Design, 19(2), 71-100.
Kreimeyer, M. F. (2010). A structural measurement system for engineering design processes.
Universitätsbibliothek der TU Mnchen,
Kröger, W., & Zio, E. (2011). Vulnerable systems: Springer.
Kurtoglu, T., & Tumer, I. (2008). A gaph-based fault identification and propagation framework for
functional design of complex systems. Journal of Mechanical Design, 130.
122
Latouche, G., Ramaswami, V., & Kulkarni, V. G. (1999). Introduction to matrix analytic methods
in stochastic modeling. Journal of Applied Mathematics and Stochastic Analysis, 12(4),
435-436.
Le Moigne, J. (1990). La théorie du système général. Théorie de la modélisation: Presses
Universitaires de France.
Lee, E., Park, Y., & Shin, J. (2008). Large engineering project risk management using a bayesian
belief network. Expert Systems with Applications, 36(3), 5880-5887.
Lee, L., Ingegneri, A., Li, M., & Everett, D. (2007). Probabilistic risk assessment: A practical &
cost effective approach.
Lee, W. T., Deng, W. Y., Lee, J., & Lee, S. J. (2010). Change impact analysis with a goal driven
traceability based approach. International Journal of Intelligent Systems, 25(8), 878-908.
Likert, R. (1932). A technique for the measurement of attitudes. Archives of psychology.
Lindemann, U., Maurer, M., & Braun, T. (2008). Structural complexity management: An approach
for the field of product design: Springer Verlag.
Lock, D. (2007). The essentials of project management: Ashgate Pub Co.
Marle, F. (2002). Modèle d’informations et méthodes pour aider à la prise de décision en
management de projets. Ecole Centrale Paris, Paris.
Marle, F. (2008). Analysis of current project risk management methodologies and required
improvements. (pp. Working Paper): Ecole Centrale Paris.
Marle, F., Vidal, L. A., & Bocquet, J. C. (2010). Interactions-based risk clustering methodologies
and algorithms for complex project management. International Journal of Production
Economics.
Marseguerra, M., Zio, E., & Martorell, S. (2006). Basics of genetic algorithms optimization for
rams applications. Reliability Engineering & System Safety, 91(9), 977-991.
Maurer, T. J., & Pierce, H. R. (1998). A comparison of likert scale and traditional measures of
self-efficacy. Journal of Applied Psychology, 83(2), 324.
123
McManus, J., & Wood-Harper, T. (2003). Information systems project management: Methods,
tools and techniques: Pearson Education.
Mészáros, C., & Rapcsák, T. (1996). On sensitivity analysis for a class of decision systems.
Decision Support Systems, 16(3), 231-240.
Meyn, S. P., Tweedie, R. L., & Glynn, P. W. (1993). Markov chains and stochastic stability:
Springer London et al.
MIL-STD-1629 (1998). Procedures for performing fmeca (revision a [1998]).
Morel, B., & Ramanujam, R. (1999). Through the looking glass of complexity : The dynamics of
organizations as adaptive and evolving systems. Organization science, 10(3), 278-293.
Nsakanda, A. L., Price, W. L., Diaby, M., & Gravel, M. (2007). Ensuring population diversity in
genetic algorithms: A technical note with application to the cell formation problem.
European Journal of Operational Research, 178(2), 634-638.
Oh, K. J., Kim, T. Y., & Min, S. (2005). Using genetic algorithm to support portfolio optimization
for index fund management. Expert Systems with Applications, 28(2), 371-379.
Pahl, G., Beitz, W., Feldhusen, J., & Grote, K. (2007). Engineering design - a systematic approach
(3rd ed.): Springer.
Pallottino, S. (1984). Shortest path methods: Complexity, interrelations and new propositions.
Networks, 14(2), 257-267.
Penalva, J.-M. (1997). La modélisation par les systèmes en situations complexes. Parix XI Orsay
Paris.
Perron, O. (1907). Zur theorie der matrices. Mathematische Annalen, 64(2), 248-263.
PMI, S. C. (2008). A guide to the project management body of knowledge (pmbok) (2008 ed.).
Newton Square, PA, USA. : Project Management Institute.
Popov, A. (2005). Genetic algorithms for optimization. User Manual, Hamburg.
Power, D. J., & Sharda, R. (2007). Model-driven decision support systems: Concepts and research
directions. Decision Support Systems, 43(3), 1044-1061.
124
PRINCE (1999). Managing successful projects with prince 2: UK: Computers and
Telecommunications Agency (CCTA).
Rajkumar, R., & Shahabudeen, P. (2009). An improved genetic algorithm for the flowshop
scheduling problem. International Journal of Production Research, 47(1), 233-249.
Raz, T., & Hillson, D. (2005). A comparative review of risk management standards. Risk
Management: An international journal, 7 (4), 53-66.
Riek, R. (2001). From experience: Capturing hard-won npd lessons in checklists. The Journal of
Product Innovation Management, 18, 301-313.
Rosato, V., Bologna, S., & Tiriticco, F. (2007). Topological properties of high-voltage electrical
transmission networks. Electric Power Systems Research, 77(2), 99-105.
Rozinat, A., Mans, R. S., Song, M., & van der Aalst, W. M. P. (2009). Discovering simulation
models. Information Systems, 34(3), 305-327.
Saaty, T. (1977). A scaling method for priorities in hierarchical structures. Journal of
Mathematical Psychology, 15, 234-281.
Saaty, T. (1980 ). The analytic hierarchy process: Planning, priority setting, resource allocation:
McGraw-Hill.
Saaty, T. (2000). Fundamentals of the analytic hierarchy process. Pittsburgh, PA: RWS
Publications.
Saaty, T. (2003). Decision-making with the ahp: Why is the principal eigenvector necessary.
European Journal of Operational Research, 145(1), 85-91.
Saltelli, A., Chan, K., & Scott, E. M. (2000). Sensitivity analysis (Vol. 134). New York: John
Wiley & Sons.
Schlindwein, S., & Ison, R. (2005). Human knowing and perceived complexity: Implications for
systems practice. Emergence: complexity & organisation, 6(3), 19-24.
Sen, P., Dasgupta, S., Chatterjee, A., Sreeram, P. A., Mukherjee, G., & Manna, S. S. (2003).
Small-world properties of the indian railway network. Physical Review E, 67(3), 036106.
125
Senouci, A., & Al-Derham, H. R. (2008). Genetic algorithm-based multi-objective model for
scheduling of linear construction projects. Advances in Engineering Software, 39(12),
1023-1028.
Shimizu, H., & Noguchi, H. (2005). Reliability problem prevention method for automotive
components-development of gd'3' activity and drbfm method for stimulating creativity and
visualizing problems. Transaction of Society of Automotive Engineers of Japan, , 36(4),
163-168.
Sinha, S., Thomson, A. I., & Kumar, B. A complexity index for the design process. In
International Conference on Engineering Design, Glasgow, 2001 (Vol. 1, pp. 157-163):
Professional Engineering Publishing, Bury St Edmunds.
Smith, P., & Merritt, G. (2002). Proactive risk management. Controlling uncertainty in product
development. New York: Productivity Press.
Smith, R., & Eppinger, S. (1997). Identifying controlling features of engineering design iteration.
Management Science, 43(3), 276-293.
Sosa, M. (2008). A structured approach to predicting and managing technical interactions in
software development. Research in Engineering Design.
Sosa, M., Eppinger, S., & Rowles, C. (2004). The misalignment of product architecture and
organizational structure in complex product development. Management Science, 50(12),
1674-1689.
Stamatelatos, M. A vision for system safety enhancement at nasa, . In Safety Directors’ Meeting,
Cocoa Beach, Florida,, 2004
Steward, D. (1981). The design structure matrix: A method for managing the design of complex
systems. IEEE Transactions in Engineering Management, 28(3), 71-74.
Stone, R., Tumer, I., & Van Wie, M. (2004). The function–failure design method. Journal of
Mechanical Design, 127(3), 397-407.
Strogatz, S. H. (2001). Exploring complex networks. Nature, 410(6825), 268-276.
Taylor, M. (1969). Influence structures. Sociometry, 490-502.
126
Thomason, M. G. (1977). Convergence of powers of a fuzzy matrix. Journal of mathematical
analysis and applications, 57(2), 476-480.
Thompson, J. (1967). Organizations in action. New York: McGraw-Hill.
Trucco, P., Cagno, E., Ruggeri, F., & Grande, O. (2008). A bayesian belief network modelling of
organisational factors in risk analysis: A case study in maritime transportation. Reliability
Engineering & System Safety, 93(6), 845-856.
Tumer, I., & Stone, R. (2001). Mapping function to failure mode during component development.
Research in Engineering Design, 14(1), 25-33.
Vidal, L.-A., Marle, F., & Bocquet, J.-C. (2011a). Measuring project complexity using the analytic
hierarchy process. International Journal of Project Management, 29(6), 718-727.
Vidal, L.-A., Marle, F., & Bocquet, J.-C. (2011b). Using a delphi process and the analytic
hierarchy process (ahp) to evaluate the complexity of projects. Expert Systems with
Applications, 38(5), 5388-5405.
Vidal, L., & Marle, F. (2008). Understanding project complexity: Implications on project
management. Kybernetes, the International Journal of Systems, Cybernetics and
Management Science.
West, D. B. (2001). Introduction to graph theory (Vol. 1): Prentice Hall Upper Saddle River, NJ.
White, D., & Fortune, J. (2002). Current practice in project management--an empirical study.
International Journal of Project Management, 20(1), 1-11.
Wilson, R. J., & Wilson, R. J. (1996). Introduction to graph theory: IMA.
Zio, E. (2007). From complexity science to reliability efficiency: A new way of looking at
complex network systems and critical infrastructures. International journal of critical
infrastructures, 3(3), 488-508.
Zio, E., & Sansavini, G. (2008). A systematic procedure for analysing network systems.
International Journal of Critical Infrastructures, 4(1), 172-184.
127
Zio, E., Sansavini, G., Maja, R., & Marchionni, G. (2008). An analytical approach to the safety of
road networks. INTERNATIONAL JOURNAL OF RELIABILITY QUALITY AND SAFETY
ENGINEERING, 15(1), 67.
128
129
List of Figures
Figure 1. Classical steps of project risk management................................................................. - 12 -
Figure 2. Representations of risk analysis results....................................................................... - 14 -
Figure 3. An example of project complexity framework (adapted from (L.-A. Vidal et al. 2011b)) ..
.................................................................................................................................................... - 16 -
Figure 4. Complexity vision of project and project risks (Marle 2008) ..................................... - 18 -
Figure 5. An example of loop phenomenon in risk propagation ................................................ - 18 -
Figure 6. Diagram of risk probability and impact....................................................................... - 20 -
Figure 7. Tree structure of risk correlations................................................................................ - 20 -
Figure 8. An example of Bayesian belief network for risk management in large engineering project
(E. Lee et al. 2008) ..................................................................................................................... - 21 -
Figure 9. Framework of the decision support system for PRM.....................................................- 25
Figure 10. Steps in the DSS for addressing related research questions .........................................- 26
Figure 11. Illustration of DSM (DSM-Community 2009).......................................................... - 32 -
Figure 12. Illustration of risk structure matrix (RSM)................................................................ - 33 -
Figure 13. Description of the transformation process from RSM to RNM ................................ - 37 -
Figure 14. RSM of the musical staging project .......................................................................... - 40 -
Figure 15. Interactions-based project risk network structure of the musical staging project...... - 40 -
Figure 16. RNM of the musical staging project.......................................................................... - 41 -
Figure 17. Simulation model of the project risk network using ARENA software .................... - 48 -
Figure 18. Sensitivity analysis results of project risks................................................................ - 54 -
Figure 19. Comparison of effects on the global risk network by applying different mitigation
actions......................................................................................................................................... - 56 -
Figure 20. RSM of the tramway project ..................................................................................... - 67 -
Figure 21. Project risk network structure of the tramway project .................................................- 68
Figure 22. Display of classical project risk analysis results ....................................................... - 70 -
Figure 23. Diagram of degree of risks ........................................................................................ - 71 -
Figure 24. Diagram of reachability degree of risks .................................................................... - 72 -
Figure 25. Interfaces between risk domains with local and global viewpoints .......................... - 72 -
Figure 26. Interfaces between risk owners with local and global viewpoints ............................ - 73 -
Figure 27. Structure of the project risk network (with highlighted important risks and interactions).
.......................................................................................................................................................- 74
Figure 28. Structure of the project risk network after taking actions ............................................- 79
Figure 29. RSM and network structure of the example .............................................................. - 86 -
Figure 30. RNM of the tramway project..................................................................................... - 90 -
130
Figure 31. A framework for risk response planning ................................................................... - 97 -
Figure 32. Illustration of the crossover operation..................................................................... - 103 -
131
List of Tables
Table 1. Definition of probability, impact, and criticality reference scales ................................ - 13 -
Table 2. Typical Project Risk List in Classical Methods ............................................................ - 19 -
Table 3. Original project risk list with characteristic values of the musical staging project ...... - 39 -
Table 4. The comparison of re-evaluated simulation results with those of classical method........- 50
Table 5. Risk prioritization results by different indicators ......................................................... - 51 -
Table 6. Evaluated three-level values of risk spontaneous probability....................................... - 53 -
Table 7. Effects of different mitigation actions on particular risks ............................................ - 55 -
Table 8. Project risk list with classical risk characteristics of the tramway project.................... - 66 -
Table 9. The top risks and interactions according to the betweenness centrality ....................... - 73 -
Table 10. The top-ten risks according to eigenvector centrality................................................. - 75 -
Table 11. The top betweenness centralities after taking actions................................................. - 78 -
Table 12. The top risks according to eigenvector centrality after taking actions ....................... - 78 -
Table 13. Risk re-evaluation and prioritization results of the simple example........................... - 87 -
Table 14. Comparison of the results by risk propagation model and by simulation................... - 89 -
Table 15. Project risk analysis results of the tramway project ................................................... - 92 -
Table 16. Risk ranking results according to eigenvector centrality............................................ - 93 -
Table 17. The list of potential risk response actions................................................................. - 104 -
Table 18. Optimization results using the greedy algorithm...................................................... - 105 -
Table 19. Comparison of the results by the greedy and genetic algorithms ............................. - 106 -
132
Résumé : La gestion des risques projet est une activité cruciale dans le management de projet. Aujourd'hui,
les projets sont confrontés à une complexité croissante et sont ainsi exposés à de nombreux risques
interdépendants. Cependant, les méthodes classiques ont des limites pour la modélisation de la
complexité réelle des risques du projet. Par exemple, certains phénomènes comme les réactions en
chaîne et des boucles ne sont pas correctement pris en compte. Cette thèse de doctorat vise à
analyser le comportement du réseau de risques projet grâce à la modélisation des risques et des
interactions entre risques. Un système d'aide à la décision est introduit avec une série de méthodes
associées. La construction du réseau de risques projet nécessite l'implication du manager de projet
et l'équipe d'experts en utilisant la méthode Design Structure Matrix (DSM). Des techniques
basées sur la simulation et la théorie des réseaux sont développées pour analyser et hiérarchiser les
risques du projet, en regard de leur rôle et leur importance dans le réseau des risques. L'approche
proposée constitue un puissant complément à l'analyse classique des risques projet. Ces nouvelles
analyses fournissent aux managers de projet une meilleure vision sur les risques et sur leurs
interactions complexes et les aident à élaborer des réponses plus efficaces. Prenant en compte les
contraintes de ressources, un algorithme glouton et un algorithme génétique sont développés pour
optimiser le plan de réponse aux risques et l'allocation des réserves budgétaires. Deux exemples
d'application, 1) à un projet réel de mise en scène musicale dans l'industrie du divertissement et 2)
à un projet réel de construction d’un système de transport urbain, sont présentés pour illustrer
l'utilité du système d'aide à la décision proposé.
Mots-clés: gestion des risques projet, complexité, interaction entre risques, réseau de risques,
analyse des risques, propagation du risque, théorie des réseaux, optimisation, système d'aide à la
décision
Abstract :
Project risk management is a crucial activity in project management. Nowadays, projects are
facing a growing complexity and are thus exposed to numerous and interdependent risks. However,
existing classical methods have limitations for modeling the real complexity of project risks. For
example, some phenomena like chain reactions and loops are not properly taken into account. This
Ph.D. thesis aims at analyzing propagation behavior in the project risk network through modeling
risks and risk interactions. An integrated framework of decision support system is presented with a
series of proposed methods. The construction of the project risk network requires the involvement
of the project manager and the team of experts using the Design Structure Matrix (DSM) method.
Simulation techniques are used and several network theory-based methods are developed for
analyzing and prioritizing project risks, with respect to their role and importance in the risk
network in terms of various indicators. The proposed approach serves as a powerful complement
to classical project risk analysis. These novel analyses provide project managers with improved
insights on risks and risk interactions under complexity and help them to design more effective
response actions. Considering resource constraints, a greedy algorithm and a genetic algorithm are
developed to optimize the risk response plan and the allocation of budget reserves dedicated to the
risk management. Two examples of application, 1) to a real musical staging project in the
entertainment industry and 2) to a real urban transportation system implementation project, are
presented to illustrate the utility of the proposed decision support system.
Keywords: project risk management, complexity, risk interaction, risk network, risk analysis, risk
propagation, network theory, optimization, decision support system